<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-phishing-infrastructure
description: >-
  Map and analyze phishing campaign infrastructure including hosting providers,
  domain registrars, nameservers, SSL certificates, redirect chains, and
  shared indicators to attribute campaigns and enable proactive takedowns.
domain: cybersecurity
subdomain: phishing-defense
tags:
  - phishing-infrastructure
  - domain-analysis
  - certificate-transparency
  - hosting-analysis
  - takedown
  - threat-intelligence
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1583.001", "T1584.001"]
---

# Analyzing Phishing Infrastructure

## Overview

Phishing campaigns rely on infrastructure — domains, hosting, certificates, and
redirect chains. Mapping this infrastructure reveals campaign scope, enables
attribution, supports takedown requests, and feeds proactive blocking. This
skill covers passive DNS analysis, certificate transparency log mining, WHOIS
correlation, redirect chain tracing, and infrastructure clustering.

## Prerequisites

| Requirement | Install |
|---|---|
| Python 3.10+ | Agent tooling runtime |
| `dig` / `host` | DNS resolution and record queries |
| `whois` | Domain and IP registration data |
| `openssl` | Certificate inspection |
| `curl` | HTTP redirect tracing |
| `jq` | JSON processing |
| `subfinder` | `go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest` |

## Key Concepts

### Infrastructure Layers

```
Layer 1 — Domain        : Registration, WHOIS, nameservers, DNS records
Layer 2 — Hosting       : IP address, ASN, hosting provider, geolocation
Layer 3 — Certificate   : SSL/TLS cert details, CT log entries, issuer
Layer 4 — Content       : Redirect chains, landing page fingerprints
Layer 5 — Correlation   : Shared registrant, IP neighbors, cert overlap
```

### Pivot Points for Clustering

| Pivot | Description |
|---|---|
| Registrant email | Same email across phishing domains |
| Nameserver | Shared NS records across campaigns |
| IP /24 block | Domains hosted on adjacent IPs |
| SSL cert serial | Wildcard or multi-SAN certs covering multiple phish domains |
| Redirect pattern | Identical redirect chain structure |
| Favicon hash | Same favicon across phishing pages |
| JARM fingerprint | TLS server fingerprinting |

### MITRE ATT&CK Mapping

| Technique | ID | Description |
|---|---|---|
| Acquire Infrastructure: Domains | T1583.001 | Register domains for phishing |
| Acquire Infrastructure: DNS Server | T1583.002 | Set up DNS for phishing |
| Acquire Infrastructure: Web Services | T1583.006 | Use web services for hosting |
| Stage Capabilities: Link Target | T1608.005 | Prepare phishing link destinations |

## Workflow

### 1. Domain Investigation

```bash
# WHOIS lookup for registration details
whois phishing-domain.com

# DNS records — A, MX, NS, TXT
dig +short A phishing-domain.com
dig +short MX phishing-domain.com
dig +short NS phishing-domain.com
dig +short TXT phishing-domain.com

# Passive DNS via agent
node agent.js domain-recon --domain phishing-domain.com
```

### 2. Certificate Transparency Analysis

```bash
# Query CT logs for related certificates
node agent.js ct-search --domain phishing-domain.com

# Inspect live certificate
echo | openssl s_client -connect phishing-domain.com:443 -servername \
  phishing-domain.com 2>/dev/null | openssl x509 -noout -text \
  | grep -E "Subject:|Issuer:|Not Before|Not After|DNS:"

# Search crt.sh for historical certs
curl -s "https://crt.sh/?q=%.phishing-domain.com&output=json" | \
  jq '.[].name_value' | sort -u
```

### 3. Hosting and Network Analysis

```bash
# IP geolocation and ASN
node agent.js ip-analysis --ip 192.0.2.1

# Check IP neighborhood for other phishing domains
node agent.js ip-neighbors --ip 192.0.2.1

# JARM fingerprint for TLS server profiling
node agent.js jarm-scan --target phishing-domain.com
```

### 4. Redirect Chain Tracing

```bash
# Follow redirect chain without executing content
curl -sIL --max-redirs 10 "https://phishing-domain.com/login" \
  2>&1 | grep -E "^(HTTP/|Location:)"

# Full redirect analysis with agent
node agent.js trace-redirects --url "https://phishing-domain.com/login"
```

### 5. Infrastructure Clustering

```bash
# Cluster related domains by shared infrastructure
node agent.js cluster --ioc-file /tmp/phishing_domains.txt \
  --pivot registrant,nameserver,ip_block
```

## Detection

```yaml
title: Phishing Infrastructure Detection
id: fdc6dcc7-e7a9-46c0-8286-ab1fdf3b9f6b
status: experimental
description: Detects suspicious activity related to analyzing phishing infrastructure techniques in phishing defense context
logsource:
  category: email
  service: o365
detection:
  selection:
    Subject: "*urgent*"
  condition: selection
level: high
tags:
  - attack.t1583.001
  - attack.t1584.001
  - attack.initial_access
falsepositives:
  - Security awareness training platform sending simulated phishing emails
```

## Verification

| Check | Method |
|---|---|
| WHOIS data collected | Registrant, dates, registrar extracted |
| DNS records mapped | A, MX, NS, TXT records captured |
| CT logs queried | Related certificates identified |
| IP analyzed | ASN, geolocation, hosting provider identified |
| Redirect chain traced | Full hop-by-hop chain documented |
| Infrastructure clustered | Related domains grouped by pivot point |

## References

- [MITRE ATT&CK T1583 — Acquire Infrastructure](https://attack.mitre.org/techniques/T1583/)
- [crt.sh Certificate Transparency Search](https://crt.sh/)
- [JARM TLS Fingerprinting](https://github.com/salesforce/jarm)
- [URLhaus Abuse Reporting](https://urlhaus.abuse.ch/)
- [Netcraft Phishing Takedown](https://www.netcraft.com/cybercrime/phishing/)
