---
title: "Datacenter Infrastructure & Identity Attacks"
url: https://daily.dev/posts/datacenter-infrastructure-identity-attacks-e5n7xovij
source_url: https://www.huntress.com/blog/datacenter-infrastructure-and-identity-attacks
type: article
source: "Huntress Blog"
published: 2026-05-31T07:43:08.109Z
updated: 2026-05-31T08:08:50.733Z
tags: ["autonomous-systems"]
reading_time: 16
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Datacenter Infrastructure & Identity Attacks

**[Huntress Blog](https://daily.dev/sources/huntress-blog)** · 16 min read · 0 upvotes · 0 comments

## Summary

Identity attacks don't just come from suspicious geographic locations or VPNs — there's a third dimension: datacenter infrastructure. Huntress ITDR researcher Matt Kiely describes how he discovered a critical detection gap: attackers were gaining initial access via datacenter IPs with no VPN/proxy tags, leaving no initial access alert despite post-exploitation activity being caught. The solution was to classify logins by Autonomous System (AS) organization rather than geography, establishing a baseline of normal datacenter activity per identity and flagging logins from high-abuse-potential AS providers (e.g., those accepting anonymous crypto). After launching in August 2025, the system reduced 10M+ datacenter auth events to a few hundred daily investigations, with a 3.2% false positive rate — better than the 4-5% baseline. The key insight: 'location' in identity security must account for geography, technology fingerprint (VPN/proxy), and underlying infrastructure (datacenter/AS).

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://www.huntress.com/blog/datacenter-infrastructure-and-identity-attacks>

## Similar posts on daily.dev

- [Essential Data Sources for Detection Beyond the Endpoint](https://daily.dev/posts/essential-data-sources-for-detection-beyond-the-endpoint-p1jtpqr3v) · Unit 42 · 0 upvotes · 0 comments
- [Identity Architecture Now Drives Cyber Risk: Techno Security & Digital Forensics Conference West 2025](https://daily.dev/posts/identity-architecture-now-drives-cyber-risk-techno-security-digital-forensics-conference-west-202-bzhiexsmv) · GitGuardian · 0 upvotes · 0 comments
- [Detecting Identity Attacks at Scale with Herd Immunity](https://daily.dev/posts/detecting-identity-attacks-at-scale-with-herd-immunity-p5gfvhfcd) · Arctic Wolf · 0 upvotes · 0 comments
- [Identity as the primary attack surface: What modern breaches are really exploiting](https://daily.dev/posts/identity-as-the-primary-attack-surface-what-modern-breaches-are-really-exploiting-6evgscdr6) · CSO Online · 0 upvotes · 0 comments

---

Tags: [#autonomous-systems](https://daily.dev/tags/autonomous-systems)

[View this post on daily.dev](https://daily.dev/posts/datacenter-infrastructure-identity-attacks-e5n7xovij)