Acquire Infrastructure: Domains is an attack technique where an adversary registers, buys, or otherwise obtains internet domains for malicious use. Those domains are then used for command-and-control, phishing, redirection, or infrastructure staging, often to support further intrusion activity while hiding the attacker’s real hosting and identity.
What this technique does
Acquiring domains gives an adversary a controllable internet property that can be pointed at malicious infrastructure, used in phishing lures, or reserved for later stages of an intrusion. The technique is attractive because it creates a legitimate-looking foothold on the public DNS layer, which can help hide infrastructure changes and make takedowns slower.
In practice, the domain itself is not the end goal, it is a reusable staging asset. Attackers may rotate names, register lookalike brands, or keep domains dormant until they are needed for delivery, redirection, or command-and-control.
Why domains are useful to attackers
Domains sit in the trust path for web, email, and many third-party services, so they can be used to make malicious activity look routine. A registered domain can host landing pages, proxy traffic, terminate TLS, or support later infrastructure without exposing the attacker’s original environment.
They also let adversaries separate the visible lure from the real backend. That separation is useful for phishing, malware staging, and traffic forwarding because defenders often see only the public-facing domain and the infrastructure behind it can be swapped or abandoned quickly.
How defenders spot exposure
Exposure checks start with domain inventory, registrar visibility, DNS monitoring, and lookalike analysis. Teams should look for newly registered domains, domains that mimic the organisation or its suppliers, and external hosts that resolve to infrastructure used in campaign delivery.
Certificate Transparency logs, passive DNS, email security telemetry, and web proxy logs can help connect a suspicious domain to infrastructure staging or brand impersonation. The most useful question is not just whether the domain exists, but whether it is being used to support a known attack path.
For a defender-oriented view of what is externally observable in this tactic, ATT&CK Resource Development Tactic Guide is the most directly relevant internal guide here.
What remediation and monitoring should focus on
When a malicious domain is identified, remediation usually involves registrar escalation, DNS sinkholing or blocking, hosting takedown requests, and blocking the domain at email, web, and network control points. If the domain supported phishing or credential capture, the response should also consider user exposure and any downstream account abuse.
Post-detection monitoring matters because the same actor can often register new domains quickly. Watch for repeated naming patterns, shared registrant details where visible, common hosting clusters, and redirected traffic that suggests the adversary is rebuilding infrastructure after disruption.
Domain-level control is also part of broader cloud and security governance, especially where organisations rely on third-party hosting, DNS services, or external suppliers. CSA Cloud Controls Matrix is a useful external reference for mapping those dependencies to control domains such as IAM, infrastructure, and supply chain.
Risk and Threat Considerations
Acquired domains are a durable abuse primitive because they are cheap to replace, easy to distribute, and difficult to distinguish from legitimate infrastructure at first glance. That creates both exposure and persistence risk, especially when they are used for phishing, traffic redirection, or command-and-control.
Failure mechanism: The attacker uses a legitimate domain registration to establish trusted-looking public infrastructure, then swaps content, redirects traffic, or stages payload delivery while defenders focus on the visible domain rather than the operator behind it.
Impact: The result can be stealthier delivery, longer dwell time, delayed takedown, and broader compromise if users, mail systems, or monitoring tools trust the domain before its purpose is recognised.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0042 — Resource Development | This tactic covers adversary infrastructure acquisition and staging before attacks. |
| Recommendation — Map suspicious domains to TA0042 and hunt for registration, staging, and delivery activity. | ||
| CIS Controls v8 | CIS-13 — Network Monitoring and Defense | Domain abuse is often found through DNS, proxy, and web traffic monitoring. |
| Recommendation — Monitor DNS and web telemetry for lookalike, newly registered, and maliciously redirected domains. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and network services are monitored to find cybersecurity events | Domain-based staging and redirection are detected through network-service monitoring. |
| RS.MA-01 — Incident mitigation is performed | Malicious domains require blocking, sinkholing, or takedown as mitigation actions. | |
| Recommendation — Monitor DNS and network services for domain registration, resolution, and redirection anomalies. Execute takedown, sinkhole, and blocking actions once a malicious domain is confirmed. | ||
| NIST SP 800-53 Rev 5 | SI-4 — System Monitoring | Suspicious domains and their use in attack paths are identified through monitoring activity. |
| Recommendation — Correlate DNS, proxy, and CT telemetry under SI-4 to detect malicious domain use. | ||
Practitioner Guidance
What to watch for: Treat newly registered, lookalike, and recently repurposed domains as a detection problem, not just a DNS hygiene issue. Prioritise domains that match your brand, supplier names, authentication flows, or common delivery patterns seen in phishing and staging activity.
Governance implication: Ownership of domain monitoring should sit with the teams that manage email security, web filtering, and threat intelligence, because no single control sees the whole path. The practical goal is to reduce the time between first registration, first use, and first enforcement action.
Practitioner takeaway: The strongest defence is early visibility into registration and resolution, followed by fast blocking or takedown once a domain is tied to malicious use.
Related resources from NHI Mgmt Group
- Acquire Infrastructure
- How should security teams respond when scam infrastructure can rapidly rotate domains and IP addresses to evade blocking?
- What happens when scam infrastructure is backed by a large provider with thousands of domains and bulk IP access?
- What should organisations do when they find impersonation domains or rogue subdomains pointing to attacker infrastructure?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org