Infrastructure & Attribution
Hosting operators, registry data, and the infrastructure threat actors depend on.
- Oct 16, 2026✦ AI-assisted
Introducing Infrastructure Actors: A Tracking Schema for the Layer Beneath Threat Actors
Threat intelligence has rich naming conventions for attackers. The layer underneath — the hosting operators who sell abuse-tolerant infrastructure to whoever's paying — has nothing comparable. This piece proposes 'Infrastructure Actor' as a tracking category and introduces INFRA-NN as its naming schema, with INFRA-01 as the first entry.
- Oct 16, 2026✦ AI-assisted
One Maintainer, Thirty Netblocks: Mapping an Iranian VPS Resale Cluster
A honeypot-scanning cluster in AS208137 resolves into a 30-netblock Iranian commercial VPS reselling operation administered through a single RIPE maintainer. Primary-source structural attribution; state-nexus claims deliberately not reached for. Introduces INFRA-01 as the first entry in an Infrastructure Actor tracking schema.
