One domain - sempersim[.]su - lit up in the ThreatFox fudge as C2 for LokiBot. After four DNS beer from this single indicator, I went to a cluster of 25+ hosts: iCloud phishing domains, Xworm and Remcos infrastructure on dynamic DNS services, a total CIDR range with 464 suspicious domains. Two hours of work, free tools, zero magic - what platforms and tools are used for such intelligence, I disassembled in the Thread Intelligence Platform Review 2025-2026.
I have not met Russian-language analysis of this methodology with real queries and specific pyot-points. So let's see step - from the first domain to the full card.
Why the infrastructure of actors is amenable to mapping
Pivoting on infrastructure does not work because the actors are incompetent. According to Censys, the causes are systemic - and are associated with how their operating room is arranged.
Scaling requires automation. The pace of cyber attacks has grown so much that every C2 server can’t twist your hands. Actors deploy the infrastructure through ready-made images or scripts, and behind them are repetitive artifacts: the same HTTP headlines, identical self-signed certificates, characteristic banners.
Separation of roles. The operator conducting the attack understands the OPSEC risks. But the infrastructure is often deployed by another team – and it doesn’t have a complete picture of what artifacts are visible to Shodan and Censys.
The need to look legitimate. Phishing domains should mimic real services (iCloud, Microsoft 365), which creates predictable name patterns. C2 servers are mimiced by standard web servers, but do it in a template.
Absence of OPSEC-by-design. According to Censys, most actors do not design infrastructure with an eye on TI-analysts. They improve OPSEC reactively - after the publication of a report on their activity, not before. This window is used.
Between the deployment of C2 and its use in the attack, time passes. During this time, the analyst can detect a server through Scan Databases database scanning (T1596.005, Reconnaissance) or analysis of Passive DNS (T1596.001, Reconnaissance)
Map of reconnaissance technicians MITRE ATT&CK
Each type of pivot is a specific technique from Reconnaissance tactics:
Context: all described below is the work of a CTI-analyst on the protection side. Mirrorly, the same equipment is used by the attacker for reconnaissance targets (T1590.001 Domain Properties, T1590.002 DNS, T1590.005 IP Addresses), but the vector is directed in the opposite direction: we explore the infrastructure of the actor, not the victim.
Passive DNS analysis: from domain to host cluster
Passive DNS is an aggregated history of DNS-prowls: which domain indicated which IP, on which dates, through which NS servers. Unlike the active DNS query, pDNS shows not the current state, but a full time scale. This is critical: Actors regularly change IP addresses, but the domain name structure and the choice of hosting providers remain stable.
Step-by-step beuring on the example of LokiBot
The real case from the Embee Research analysis. Starting point - domain sempersim[.]su, recorded on ThreatFox as LokiBot C2.
Step 1: History of IP. A domain request in Validin (or similar pDNS service) returns a complete list of IP addresses that the domain has been pointed out since 2022. A bunch of short-lived IPs means the actor regularly rotates the infrastructure. Probably in response to the blocking.
Step 2: Brew on the latest IP. The most recent IP - 104.237.252[.]28. The reverse query (pivot on IP) shows all domains that have celebrated to this address in the last two weeks. Result: 6 domains, four of which mimic iCloud (used l Instead of I - lcloud.com[.]de) Classic typosquatting.
Step 3: Lookalike-search. Phishing domain lcloud.com[.]de It's a pattern. Search for similar domains (lookalike feature) returns more than a thousand results with a similar typo. The first of them – lcloud.com[.]se - leads to IP 194.195.220[.]41 (the octet is verified by the original Embee Research) with 9 detectives on the VirusTotal and connections with the Bagle worm.
And here it becomes interesting for the attribution of APT groupings: two different families of smallware (LokiBot and Bagle) share the infrastructure or use one domain name pattern. Accurate attribution goes beyond one pivot, but the connection is fixed - and it can be developed.
Extension via CIDR-band
Another example from the same study. Domain marxrwo9090.duckdns[.]org (Xworm, ThreatFox) resorted on 194.147.140[.]138. A beer by IP reveals 25 domains on duckdns, one of which directly contains febxworm39090 in the name. Well, thanks for the hint.
Next is the extension to the CIDR. IP belongs to the range 194.147.140.0/24. The request for all /24 in the pDNS service returns 1468 domains, of which 464 use duckdns. First of the results - elastolut.duckdns[.]org - has 11 detectives on VT and is associated with Remcos.
Passive DNS shows the connections between domains and IP. Shodan for OSINT and Censys threat hunting solve a different problem: they index what is running on these IPs - open ports, HTTP headers, TLS certificates, service banners. This allows you to cluster hosts not by DNS history, but by configuration.
Clustering on HTTP headers
Classic - detection of Cobalt Strike servers. According to Censys, the typical response of the default CS server: HTTP 404, Content-Type text/plain, Content-Length 0, the presence of a Date-heading and no Server-heading. No legitimate web server generates such a default combination.
Not all results will be Cobalt Strike - but as a primary filter works reliably. Each IP found is further checked through pDNNS to bind to specific domains and campaigns.
Limitation: Cobalt Strike Malleable C2 Profiles allow operators to customize the answer headers. Profiles with a Server-headed and modified Content-Type evade this filter. So the search for headlines hits against default and lazy installations - and there are historically enough of them in public bases.
Pivoting on TLS-certificates
Certificates are one of the strongest pivot points for mapping the infrastructure of hackers. Actors often reuse self-signed certificates on multiple servers or leave characteristic patterns in Distinguished Name.
An example from the NCSC UK report (July 2020): APT29 (Cozy Bear) has attacked organizations associated with the development of the COVID-19 vaccine through the wellMess and WellMail maqua. The grouping used specific self-signed certificates, which allowed all connected servers to be traced back to SHA-256. Censys directly writes: such certificates "made them easy to track, as reported by sources several""According to several sources, this made it easier to track them.".
For Cobalt Strike there is a default certificate with SHA-256:
Code:
87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c
Searching for this hash in Censys instantly issues all CS installations with a default certificate. But CS is just one example. JARM-fingerprint (a hash calculated from the features of the TLS-handshake server) allows you to cluster servers by type even without matching the certificates.
crt.sh for reconnaissance through Certificate Transparency
Certificate Transparency (CT) - public logs of all issued TLS certificates. The crt.sh service searches for a domain and returns all the certificates ever issued, including subdomain equipment. It works for free and without limits - a rarity for reconnaissance on certificates.
Request %.example[.]com in rc.sh will return all certificates for subdomains - including staging, lv, internal services that the actor may not have suggested publicly available. Each subdomain found is further checked through pDNS to find out the current and historical IP.
I have not met Russian-language analysis of this methodology with real queries and specific pyot-points. So let's see step - from the first domain to the full card.
Why the infrastructure of actors is amenable to mapping
Pivoting on infrastructure does not work because the actors are incompetent. According to Censys, the causes are systemic - and are associated with how their operating room is arranged.
Scaling requires automation. The pace of cyber attacks has grown so much that every C2 server can’t twist your hands. Actors deploy the infrastructure through ready-made images or scripts, and behind them are repetitive artifacts: the same HTTP headlines, identical self-signed certificates, characteristic banners.
Separation of roles. The operator conducting the attack understands the OPSEC risks. But the infrastructure is often deployed by another team – and it doesn’t have a complete picture of what artifacts are visible to Shodan and Censys.
The need to look legitimate. Phishing domains should mimic real services (iCloud, Microsoft 365), which creates predictable name patterns. C2 servers are mimiced by standard web servers, but do it in a template.
Absence of OPSEC-by-design. According to Censys, most actors do not design infrastructure with an eye on TI-analysts. They improve OPSEC reactively - after the publication of a report on their activity, not before. This window is used.
Between the deployment of C2 and its use in the attack, time passes. During this time, the analyst can detect a server through Scan Databases database scanning (T1596.005, Reconnaissance) or analysis of Passive DNS (T1596.001, Reconnaissance)
Map of reconnaissance technicians MITRE ATT&CK
Each type of pivot is a specific technique from Reconnaissance tactics:
Context: all described below is the work of a CTI-analyst on the protection side. Mirrorly, the same equipment is used by the attacker for reconnaissance targets (T1590.001 Domain Properties, T1590.002 DNS, T1590.005 IP Addresses), but the vector is directed in the opposite direction: we explore the infrastructure of the actor, not the victim.
Passive DNS analysis: from domain to host cluster
Passive DNS is an aggregated history of DNS-prowls: which domain indicated which IP, on which dates, through which NS servers. Unlike the active DNS query, pDNS shows not the current state, but a full time scale. This is critical: Actors regularly change IP addresses, but the domain name structure and the choice of hosting providers remain stable.
Step-by-step beuring on the example of LokiBot
The real case from the Embee Research analysis. Starting point - domain sempersim[.]su, recorded on ThreatFox as LokiBot C2.
Step 1: History of IP. A domain request in Validin (or similar pDNS service) returns a complete list of IP addresses that the domain has been pointed out since 2022. A bunch of short-lived IPs means the actor regularly rotates the infrastructure. Probably in response to the blocking.
Step 2: Brew on the latest IP. The most recent IP - 104.237.252[.]28. The reverse query (pivot on IP) shows all domains that have celebrated to this address in the last two weeks. Result: 6 domains, four of which mimic iCloud (used l Instead of I - lcloud.com[.]de) Classic typosquatting.
Step 3: Lookalike-search. Phishing domain lcloud.com[.]de It's a pattern. Search for similar domains (lookalike feature) returns more than a thousand results with a similar typo. The first of them – lcloud.com[.]se - leads to IP 194.195.220[.]41 (the octet is verified by the original Embee Research) with 9 detectives on the VirusTotal and connections with the Bagle worm.
And here it becomes interesting for the attribution of APT groupings: two different families of smallware (LokiBot and Bagle) share the infrastructure or use one domain name pattern. Accurate attribution goes beyond one pivot, but the connection is fixed - and it can be developed.
Extension via CIDR-band
Another example from the same study. Domain marxrwo9090.duckdns[.]org (Xworm, ThreatFox) resorted on 194.147.140[.]138. A beer by IP reveals 25 domains on duckdns, one of which directly contains febxworm39090 in the name. Well, thanks for the hint.
Next is the extension to the CIDR. IP belongs to the range 194.147.140.0/24. The request for all /24 in the pDNS service returns 1468 domains, of which 464 use duckdns. First of the results - elastolut.duckdns[.]org - has 11 detectives on VT and is associated with Remcos.
Passive DNS shows the connections between domains and IP. Shodan for OSINT and Censys threat hunting solve a different problem: they index what is running on these IPs - open ports, HTTP headers, TLS certificates, service banners. This allows you to cluster hosts not by DNS history, but by configuration.
Clustering on HTTP headers
Classic - detection of Cobalt Strike servers. According to Censys, the typical response of the default CS server: HTTP 404, Content-Type text/plain, Content-Length 0, the presence of a Date-heading and no Server-heading. No legitimate web server generates such a default combination.
Not all results will be Cobalt Strike - but as a primary filter works reliably. Each IP found is further checked through pDNNS to bind to specific domains and campaigns.
Limitation: Cobalt Strike Malleable C2 Profiles allow operators to customize the answer headers. Profiles with a Server-headed and modified Content-Type evade this filter. So the search for headlines hits against default and lazy installations - and there are historically enough of them in public bases.
Pivoting on TLS-certificates
Certificates are one of the strongest pivot points for mapping the infrastructure of hackers. Actors often reuse self-signed certificates on multiple servers or leave characteristic patterns in Distinguished Name.
An example from the NCSC UK report (July 2020): APT29 (Cozy Bear) has attacked organizations associated with the development of the COVID-19 vaccine through the wellMess and WellMail maqua. The grouping used specific self-signed certificates, which allowed all connected servers to be traced back to SHA-256. Censys directly writes: such certificates "made them easy to track, as reported by sources several""According to several sources, this made it easier to track them.".
For Cobalt Strike there is a default certificate with SHA-256:
Code:
87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c
Searching for this hash in Censys instantly issues all CS installations with a default certificate. But CS is just one example. JARM-fingerprint (a hash calculated from the features of the TLS-handshake server) allows you to cluster servers by type even without matching the certificates.
crt.sh for reconnaissance through Certificate Transparency
Certificate Transparency (CT) - public logs of all issued TLS certificates. The crt.sh service searches for a domain and returns all the certificates ever issued, including subdomain equipment. It works for free and without limits - a rarity for reconnaissance on certificates.
Request %.example[.]com in rc.sh will return all certificates for subdomains - including staging, lv, internal services that the actor may not have suggested publicly available. Each subdomain found is further checked through pDNS to find out the current and historical IP.
