ATTACK INFRASTRUCTURE · one confirmed finding → the attacker's whole network of servers, certificates and sites

One confirmed phishing site → the servers, certificates and sister domains it shares. That is the attacker's infrastructure: take down all of it, not one site.

Two views of the same thing: an infrastructure map starts from one confirmed site and follows what it shares (below); an operation groups every confirmed site that belongs to the same attacker — all sites on one map →. Each map adds to the operations; an operation card drafts the takedowns of all its sites.

Infrastructure maps · 2