# Building Adversary Infrastructure Tracking System

Build an automated system to track adversary infrastructure using passive DNS...

- Repository: https://github.com/AgentFlocks/flocks (504 stars)
- Category: Security
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add AgentFlocks/flocks --skill building-adversary-infrastructure-tracking-system -g -a claude-code -y`
Codex: `npx skills add AgentFlocks/flocks --skill building-adversary-infrastructure-tracking-system -g -a codex -y`
Cursor: `npx skills add AgentFlocks/flocks --skill building-adversary-infrastructure-tracking-system -g -a cursor -y`
Gemini CLI: `npx skills add AgentFlocks/flocks --skill building-adversary-infrastructure-tracking-system -g -a gemini-cli -y`

## Description

Build an automated system to track adversary infrastructure using passive DNS, certificate transparency, WHOIS data, and IP enrichment to map and monitor threat actor command-and-control networks.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Building Adversary Infrastructure Tracking System

## Overview

Adversary infrastructure tracking uses passive DNS records, certificate transparency logs, WHOIS registration data, and IP enrichment to discover, map, and monitor threat actor command-and-control (C2) networks. Attackers frequently reuse hosting providers, registrars, SSL certificates, and naming patterns across campaigns, enabling analysts to pivot from known indicators to discover new infrastructure. This skill covers building an automated tracking system that identifies infrastructure relationships, detects newly registered domains matching adversary patterns, and maintains a continuously updated map of threat actor networks.


## When to Use

- When deploying or configuring building adversary infrastructure tracking system capabilities in your environment
- When establishing security controls aligned to compliance requirements
- When building or improving security architecture for this domain
- When conducting security assessments that require this implementation

## Prerequisites

- Python 3.9+ with `requests`, `dnspython`, `python-whois`, `shodan`, `networkx` libraries
- API keys: SecurityTrails, PassiveTotal/RiskIQ, Shodan, VirusTotal
- Access to passive DNS data sources
- Understanding of DNS infrastructure, hosting, and domain registration
- Graph database (Neo4j) or NetworkX for relationship visualization

## Key Concepts

### Passive DNS

Passive DNS captures historical DNS resolution data, recording which domains resolved to which IPs and when. Unlike active DNS queries, passive DNS preserves historical relationships even after records change, enabling analysts to track infrastructure changes, identify shared hosting patterns, and discover related domains that resolved to the same IP addresses over time.

### Infrastructure Pivoting

The rest: https://github.com/AgentFlocks/flocks/blob/HEAD/.flocks/flockshub/plugins/skills/Anthropic-Cybersecurity-Skills/building-adversary-infrastructure-tracking-system/SKILL.md