huntress.comwriteupDatacenter Infrastructure & Identity Attacks
A Huntress ITDR product researcher describes discovering, via "signal co-occurrence" analysis, that many confirmed identity account-takeover attacks lacked a detected initial-access alert. Investigating 10+ million authentication events revealed attackers increasingly using datacenter/VPS IP space (not flagged as VPN/proxy/Tor) to blend in, so the team built a new detector that classifies logins by Autonomous System (AS) reputation (e.g., flagging providers like Latitude.sh that accept anonymous crypto payment) instead of relying on geolocation or "impossible travel," cutting a major detection gap after going live in August 2025.
TL;DR Huntress explains how classifying login IPs by datacenter/Autonomous System (not geography or VPN tagging alone) closed a major initial-access detection gap in their ITDR product.
Technologies named here
- Huntress Managed Identity Threat Detection and Response
- Microsoft Azure
- Unwanted Access
- Cloudflare
- Spur
- Zscaler
- Amazon
- Latitude.sh
- VPN
- Tor
- Azure
- Huntress Managed ITDR
Techniques named here
- Signal co-occurrence analysis
- Location-based anomalous login detection
- VPN/proxy/tunnel detection
- Impossible travel detection
- Datacenter IP detection
- Cross-session IP-type correlation
- Autonomous System-based threat hunting
- AS abuse-potential scoring
- Post-exploitation detection
Related in Blue Team & Detection
huntress.comwriteupAI-Coded Malware | Analyzing Vibe-Coded AD Enumeration | Huntress
blog.talosintelligence.comtoolIntroducing CAIRN: Frontier tracking for AI-integrated malware (Cisco Talos)
huntress.comwriteupInside an Oracle Database SQL Injection Attack | Huntress
huntress.comwriteup