An infrastructure indicator is a technical clue tied to the network or web infrastructure behind an activity, such as a domain name, IP address, URL, name server, or certificate. Analysts use these clues to connect current traffic, downloads, or malware callbacks to infrastructure that has been seen before in malicious operations.
In cyber security, infrastructure indicators matter because the same servers, domains, or hosting patterns are often reused, rotated, or repurposed by attackers. A domain previously associated with command-and-control traffic may not prove attribution on its own, but it can strongly raise suspicion and help defenders prioritize quarantine, logging, and deeper analysis. Security teams compare these indicators against threat intelligence, DNS records, proxy logs, and endpoint telemetry to spot overlaps with known campaigns. Defenders also use them to block access, sinkhole malicious domains, and hunt for related activity across the environment.