building-adversary-infrastructure-tracking-system

name	building-adversary-infrastructure-tracking-system
description	Build an automated system to track adversary infrastructure using passive DNS, certificate transparency, WHOIS data, and IP enrichment to map and monitor threat actor command-and-control networks.
domain	cybersecurity
subdomain	threat-intelligence
tags	["infrastructure-tracking","passive-dns","c2","whois","threat-actor","pivoting","threat-intelligence","domain-analysis"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"]

Building Adversary Infrastructure Tracking System

Overview

Adversary infrastructure tracking uses passive DNS records, certificate transparency logs, WHOIS registration data, and IP enrichment to discover, map, and monitor threat actor command-and-control (C2) networks. Attackers frequently reuse hosting providers, registrars, SSL certificates, and naming patterns across campaigns, enabling analysts to pivot from known indicators to discover new infrastructure. This skill covers building an automated tracking system that identifies infrastructure relationships, detects newly registered domains matching adversary patterns, and maintains a continuously updated map of threat actor networks.

When to Use

• When deploying or configuring building adversary infrastructure tracking system capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• Python 3.9+ with requests, dnspython, python-whois, shodan, networkx libraries
• API keys: SecurityTrails, PassiveTotal/RiskIQ, Shodan, VirusTotal
• Access to passive DNS data sources
• Understanding of DNS infrastructure, hosting, and domain registration
• Graph database (Neo4j) or NetworkX for relationship visualization

Key Concepts

Passive DNS

Passive DNS captures historical DNS resolution data, recording which domains resolved to which IPs and when. Unlike active DNS queries, passive DNS preserves historical relationships even after records change, enabling analysts to track infrastructure changes, identify shared hosting patterns, and discover related domains that resolved to the same IP addresses over time.

Infrastructure Pivoting

Pivoting identifies related infrastructure by following connections: IP pivot (find all domains on an IP), domain pivot (find all IPs a domain resolved to), WHOIS pivot (find domains with same registrant), certificate pivot (find hosts sharing SSL certificates), and NS/MX pivot (find domains using same name servers or mail servers).

Adversary Infrastructure Patterns

Threat actors exhibit patterns: preferred registrars (Namecheap, REG.RU, Tucows), preferred hosting (bulletproof hosting providers, cloud services), domain generation algorithms (DGA), consistent naming patterns, and certificate reuse across campaigns.

Workflow

Step 1: Passive DNS Infrastructure Discovery

 requests
 json
 collections  defaultdict
 datetime  datetime

 :
     ():
        .st_key = securitytrails_key
        .vt_key = vt_key
        .shodan_key = shodan_key
        .infrastructure_graph = defaultdict(: {: (), : []})

     ():
        
        headers = {: .st_key}
        url = 
        resp = requests.get(url, headers=headers, timeout=)
         resp.status_code == :
            records = resp.json().get(, [])
            history = []
             record  records:
                 value  record.get(, []):
                    history.append({
                        : domain,
                        : value.get(, ),
                        : record.get(, ),
                        : record.get(, ),
                        : record.get(, ),
                    })
            ()
             history
         []

     ():
        
        headers = {: .st_key}
        url = 
        resp = requests.get(url, headers=headers, timeout=)
         resp.status_code == :
            blocks = resp.json().get(, [])
            domains = []
             block  blocks:
                 site  block.get(, []):
                    domains.append(site)
            ()
             domains
         []

     ():
        
        headers = {: .st_key}
        url = 
        resp = requests.get(url, headers=headers, timeout=)
         resp.status_code == :
            data = resp.json()
            whois_data = {
                : domain,
                : data.get(, ),
                : data.get(, ),
                : data.get(, ),
                : data.get(, []),
                : data.get(, ),
                : data.get(, ),
                : data.get(, ),
            }
             whois_data
         {}

     ():
        
        discovered = {: (), : (), : []}

         indicator_type == :
            discovered[].add(seed_indicator)
            
            pdns = .passive_dns_lookup(seed_indicator)
             record  pdns:
                ip = record[]
                discovered[].add(ip)
                discovered[].append({
                    : seed_indicator, : ip,
                    : ,
                    : record[],
                    : record[],
                })

                 depth > :
                    
                    reverse_domains = .reverse_ip_lookup(ip)
                     rd  reverse_domains[:]:
                        discovered[].add(rd)
                        discovered[].append({
                            : rd, : ip,
                            : ,
                        })

         indicator_type == :
            discovered[].add(seed_indicator)
            domains = .reverse_ip_lookup(seed_indicator)
             domain  domains[:]:
                discovered[].add(domain)
                discovered[].append({
                    : domain, : seed_indicator,
                    : ,
                })

        (
              
              
              )
         discovered

tracker = InfrastructureTracker(
    securitytrails_key=,
    vt_key=,
)