# Tracking Adversary Infrastructure with ValidIn and URLScan.io In this post, I want to share some threat hunting techniques I’ve honed over time while investigating adversary infrastructure using crowdsourced and freemium tools. While enterprise tools are powerful, you don't always need a massive budget to find evil. I heavily rely on open-source intelligence (OSINT) to find correlations and context for ongoing phishing campaigns. This guide is designed for beginners or anyone seeking to enhance their pivot skills without incurring significant costs. > **Disclaimer**: These techniques were developed through random OSINT research to understand infrastructure correlations. The goal here is to demonstrate the *methodology* of pivoting. This blog may appeal to individuals who rely heavily on crowd-sourced feed sources for threat hunting, as well as to beginners in the field who prefer not to make significant investments at the start of their careers. ### Phase 1: The Spark( Intelligence-Led Hunting) My curiosity usually starts with reading research from the community. Recently, I was reading a Mandiant article titled ***Defending Against UNC3944: Cybercrime Hardening Guidance from the Frontlines***. It detailed the operations of **Scattered Spider (UNC3944)**, a financially motivated group known for aggressive social engineering. If you are interested in learning about Scattered Spider’s modus operandi/TTPs, [read here](https://cloud.google.com/blog/topics/threat-intelligence/unc3944-proactive-hardening-recommendations). One section caught my eye: the group's specific patterns for registering phishing domains. \[Fig. 1\] --- ![Fig1](https://cdn.hashnode.com/res/hashnode/image/upload/v1764267126630/ac52e707-02ab-4ff1-8f27-680c99cbd8e3.png align="center") --- *Fig. 1: Phishing Domain Registration Pattern mentioned in the blog* I became curious and attempted to search a database of newly registered domains that I had created and managed on my local machine over the previous two years. Similarly, I recall similar domain registration patterns last year that impersonated the "Okta" service and targeted multiple brands.
💡
Johannes Ullrich's well-written script hack for quickly finding similar patterned domains inspired me to add a personal touch to my search.
%[https://isc.sans.edu/diary/Scattered+Spider+Related+Domain+Names/32162] ### The Hypothesis Based on Scattered Spider's history, they often use keywords like `help`, `vpn`, `sso`, and `servicenow`. However, given their recent campaigns targeting Salesforce customers, I hypothesized they might be shifting focus. I searched my local NRD database for the keyword **"salesforce"**. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1764269059218/e41324af-8f48-4d6d-a7fc-8b55b9cf1ccf.png align="center") Out of four results, one stood out immediately. On **November 22, 2025**, the domain `salesforce-logs[.]com` was registered. * **Hosting IP:** `193.143.1.220` * **ASN:** AS198953 (PROTON66) ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1764269407808/e2a0fde7-e4e3-4f69-b5c2-23f6a13e31e2.png align="center") This ASN is frequently associated with bulletproof hosting or malicious activity (Ref: [ThreatFox](https://threatfox.abuse.ch/asn/198953)), which was my first red flag. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1764269634676/148108b7-1d72-4777-82ee-73221ec43e4f.png align="center") *Ref:* [*https://threatfox.abuse.ch/asn/198953*](https://threatfox.abuse.ch/asn/198953) ### Phase 2: The Pivot (Validin) Now that we have a suspicious indicator ( `salesforce-logs[.]com` ), we need to see how deep the rabbit hole goes. This is where **ValidIn** shines for correlating Passive DNS (pDNS) data. Upon checking the IP `193.143.1.220` in ValidIn, I noticed a change in ownership around November 27, 2025. More importantly, the IP hosted a cluster of domains following a very specific theme. \[Fig. 2\] ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1764270335954/bd2eedc3-7d57-495b-9a04-7a72fc527da4.png align="center") *Fig. 2: Passive DNS of the IP* The adversary wasn't just targeting Salesforce; they were building infrastructure to impersonate **email marketing automation** platforms such as ActiveCampaign, SendGrid, MailerLite, and ConvertKit. ```plaintext activecarnpaignes[.]com activecarnpaigns[.]com serdgrid[.]com salesforce-logs[.]com converts-kits[.]com mailerlite-logs[.]com ``` Using ValidIn’s **Lookalike** feature and with the deduced pattern `*-logs.com` from the above cluster, the search revealed 24 similar domains, confirming a wider campaign targeting marketing tools: ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1764274929293/ceccb368-35f8-441b-842d-f5412eb5065d.png align="center") Fig. 3: Validin Lookalike Feature for \*-log.com ```plaintext mailjet-logs.com mailchimp-logs.com mailerlite-logs.com ``` At this stage, we have successfully mapped the **infrastructure**. We know *what* they are building, but we don't yet know *how* they are using it. ### Phase 3: The Context (URLScan.io) To understand the attack vector without touching the malicious infrastructure directly, we turn to [**URLScan.io**](http://URLScan.io). We searched for our original suspect: `salesforce-logs[.]com`. #### The "Evasion" Red Flag You might notice scans redirecting to `www.google.com`. This is a classic evasion technique. If the phishing kit detects a scanner or a bot (like URLScan's automated browser), it redirects to a benign site (Google) to hide the true phishing page. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1764276258602/f08667fd-8b52-4052-bde8-ded98f02a6dd.png align="center") *Fig. 4: Scans of salesforce-logs\[.\]com on URLScan* However, some scans succeeded. The results confirmed the domain was hosting a **fake Salesforce Marketing Cloud login page**. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1764276007211/4e303417-49e8-43b6-be37-88f1abeb94f0.png align="center") Whatever we suspected about the uncovered domains is now confirmed. Similarly, we can check individual domains. In the below example for serdgrid\[.\]com we have identified the similar pattern, i.e., the phishing page hosted on a subdomain with `login` keyword. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1764277373786/1e0ae3bb-4795-4632-8b6c-08723c88bbd1.png align="center") #### Finding the Delivery Vector How is this reaching victims? This is where the **Redirects** tab in URLScan is a goldmine. **Most of the time, the Redirects tab in the URLScan tells us the story that we are looking for.** ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1764278219407/3afa5512-f4a1-4ca1-9b07-34faab9262dc.png align="center") By analysing the redirect chain for a related domain (`salesforce-logs[.]com`), we can reconstruct the narrative. The scan data showed the link was likely delivered via a "Trailhead Account Verification" lure. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1764278641382/9beddce3-b72d-4c7e-b4c0-54eb4c4b5cce.png align="center") *Fig. 5: Inspecting* ***Redirects*** *section from* [*URLScan*](https://urlscan.io/result/019abb84-428a-77e4-9374-e2707f86f497/#redirects) Similarly, `serdgrid[.]com` was used to create a fake scenario claiming a "SendGrid API Key was paused due to violations." This creates urgency—a classic social engineering tactic to encourage the user to click and "log in" to the fake platform. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1764279246977/e21d3af9-5b97-43c9-a46f-d0f10348475a.png align="center") ### Conclusion In this hunt, we focused heavily on **Passive DNS** and **Lookalike Domains**. These are powerful *Indicators of Future Attack (IOFA)*—breadcrumbs the adversary leaves behind while building their infrastructure *before* they launch the first phishing email. You don't need a million-dollar budget to start. You only need curiosity, a few bookmarkable tools, and the patience to follow the thread when you notice something unusual. Start with a keyword. Pivot on the IP. Verify the intent. Happy hunting!