Open Season: Hunting Adversary Infrastructure With Free Data
Introducing a recurring series from the THOR Collective. All free tools, no vendor gatekeeping
The threat intelligence industry has spent years selling practitioners a lie: that hunting takes a budget.
You have heard the pitch on every sales call. The good data is gated, the real pivots need an enterprise license, and mapping an adversary’s infrastructure runs six figures before you start. Everything cheaper is for hobbyists.
It was never true, and this series is the proof.
The internet already records adversary infrastructure constantly, in public and for free, if you know where to look. Every certificate an operator mints gets logged by the CA that issued it. Passive sensors keep the domains they resolve long after those domains go dark. Scanners banner-grab exposed services within hours, registration paperwork carries a timestamp, and anything leaked to a public repo sits there until someone finds it. None of this needs permission, and most of it predates the vendors now reselling it to you at a markup.
That is the first ground rule, and it does not bend. Every source in this series is free to reach, no enterprise license, no “contact sales.” Where a paid tool genuinely helps, it shows up as an optional upgrade and the core method still runs without it. A technique that only works with a paid key is not in here. A practitioner with a terminal and no budget can run everything that follows.
Reading defensive data offensively
Most analysts meet these sources from the defensive side, watching their own walls. You monitor Certificate Transparency in case someone mis-issues a cert for your domain, check passive DNS to see where your own infrastructure resolved, scan your external surface, and grep public repos for your leaked secrets. Useful work, all of it, and all of it reactive.
This series is about turning the telescope around.
Point the same tools the other way and they do offensive work without complaint. The Certificate Transparency log that warns you about a phished brand will also surface the staging domains an actor certed last night, before the first email goes out. Passive DNS that maps your own footprint reverses an adversary’s IP into every domain that shared it. The scanners inventorying your attack surface will flag a Cobalt Strike team server hiding behind a redirector. The queries are identical; only who you aim them at changes.
That shift is the whole discipline: you stop waiting for an alert and start finding the campaign while it is still being built. It costs nothing but the time to learn the queries.
What this is, and what it is not
Open Season is a methodology series. Each installment takes a single freely accessible data source and walks it end to end: what the source actually tells you, why adversaries leave traces in it whether they want to or not, how to query and pivot through it, how to enrich and correlate it against the other sources, a hunt hypothesis you can lift and run, and a tooling quick reference. Soup to nuts, one source at a time.
It is written for practitioners. Threat hunters, detection engineers, CTI analysts, IR leads. People who will actually open the terminal. There is no executive summary energy here, no “in today’s evolving threat environment.” If you want a vendor whitepaper, there are a thousand of those and they are easy to find. This is the other thing.
It is also not a story series. The THOR Collective does narrative threat intelligence elsewhere, the “From the Fire” kind, behavioral and contextual. Open Season is the opposite register. Straight hunt methodology, structured, repeatable, the kind of thing you keep open in a second tab while you work.
The map
Each installment stands on its own, but they compound, because real hunting is never one source. You pivot from a cert to an IP to a domain to a registrant to a repo, and the picture assembles across all of them.
Certificate Transparency. Every public cert, logged forever, queryable for free through crt.sh. Issuance timing, SAN analysis, naming conventions, real-time monitoring of new certs as they are minted. The fastest way to catch infrastructure before it goes live.
Passive DNS. The historical record of what resolved where, and when. Reverse an IP into its co-resident domains, time-window the noise out, cluster operations by shared hosting and nameservers. Anchored on community-run data, not vendor gates.
Internet Scan Data. What a box is actually running. Open ports, banners, TLS fingerprints. JARM and JA4 to identify C2 frameworks even behind a redirector, with tools you run yourself for nothing.
WHOIS and Registration Intelligence. The paperwork, in the post-GDPR, RDAP era. What still leaks after redaction: registration timing, nameserver patterns, registrar choices, and the historical records that predate privacy.
Code and Paste Repositories. Where operators leak their own tooling, configs, and credentials. GitHub, GitLab, paste sites. Reading the adversary’s OPSEC failures off the public record.
Front Companies and Fraudulent Employment. The capstone, where every prior source converges on a single live problem: hunting DPRK IT worker operations and the shell infrastructure that supports them.
To keep the methodology concrete, the series hunts one live operation the whole way down. Ghost Stadium is the FIFA World Cup 2026 ticket-phishing kit that Group-IB and CybelAngel attribute to a Chinese-speaking, financially motivated operator, and it has stood up thousands of lookalike domains ahead of the tournament. Each installment works it with that installment’s lens, then hands the next one a live node to carry forward. The capstone deliberately flips to a different adversary, to show the pivots do not care who they are aimed at.
Why free matters
A last word on the free rule, because it holds up everything else.
Paywalls do two kinds of damage. The obvious one is exclusion: small teams, students, nonprofits, and underfunded defenders get locked out. The quieter one is rot. Techniques only a handful of licensed analysts can run never get taught or pressure-tested, the community loses its ability to check the vendors’ work, and the shared skill base shrinks.
Free, community-run data behaves the opposite way. People share it, fork it, script against it, improve it. A couple of classic sources went commercial while this series was being written, and each time the community routed around the paywall and built something open. The way to protect that is to keep using it and teaching it, and to stop treating a purchase order as the price of entry.
So: pick up the queries and point the telescope the other way. The adversary’s infrastructure is already on the public record, and you already have what you need to find it.
Part 1 starts with the source that catches infrastructure before it is even live: Certificate Transparency.
Open Season is a recurring series from the THOR Collective exploring how practitioners can use open-source data to hunt adversary infrastructure. Each installment covers a single data source, soup to nuts. Want to contribute an installment or suggest a data source? Reach out.