> ## Content Index > Fetch the complete content index at: https://blog.quimerax.com/llms.txt > Use this file to discover other available public pages before exploring further. # How the correlation of IPs, domains, hashes and URLs works in practice - URL: https://blog.quimerax.com/how-the-correlation-of-ips-domains-hashes-and-urls-works-in-practice/ - Published: 2026-11-13T03:48:09.000Z - Updated: 2026-11-13T03:48:09.000Z - Author: Leonardo Santos In October 2023, security researchers identified a phishing campaign targeting customers of Brazilian banks. The first signal was simple: a newly registered domain with a misspelling of the name of a well-known financial institution. Isolated, that signal could have been dismissed as just another opportunistic registration, the kind of thing that happens hundreds of times a day on the internet. But when that domain was correlated with other available indicators, the picture changed completely. The server hosting the domain had been used weeks earlier in another phishing campaign against the same sector. The TLS certificate issued for that domain had been generated using the same provider and the same timing pattern as other already flagged domains. The hosting IP address appeared in an address block with a history of use by groups specialized in financial fraud in Latin America. What looked like an isolated signal turned out to be part of a coordinated campaign. And the difference between treating it as a generic indicator and understanding it as part of a specific operation was entirely in the correlation. ## **What indicator correlation is and why it exists** Indicator correlation is the process of automatically relating different types of technical evidence to identify connections that would not be visible when analyzing each element in isolation. The need for this practice comes from a simple reality: cyberattacks are not one-off events. They are operations made up of multiple stages, each leaving different traces in different places. A typical attack involves a domain for the phishing phase, an IP for the malware command and control server, one or more hashes for the malicious files deployed, URLs for data exfiltration and, frequently, infrastructure shared with other attacks by the same group. Analyzing each of these elements in isolation is like trying to solve a puzzle by looking at one piece at a time without ever seeing what is around it. Correlation is what makes it possible to see the full picture. ## **How IPs reveal more than they seem to** An IP address, analyzed in isolation, says little. It may be on a negative reputation list, which indicates that it was used in malicious activity at some point, or it may not be on any list, which does not necessarily mean that it is legitimate. Contextual analysis of an IP starts with questions that go beyond point-in-time reputation. Does this address belong to a hosting block historically associated with malicious infrastructure? Are other IPs in the same block active in campaigns now? Does this address share TLS certificates with already flagged domains? Is there a timing pattern in the use of this IP that suggests a coordinated operation? A concrete example of how this analysis works in practice: in 2024, researchers identified a series of servers used in malware campaigns against companies in the Brazilian logistics sector. The IPs were individually unknown and did not appear on blacklists. But they all shared an identical server configuration pattern, used the same hosting provider and had been provisioned in the same time window. Correlation revealed that this was new infrastructure prepared specifically for that campaign, something that individual analysis of each IP would never have revealed. ## **What domains connect when they are correlated** Domains are among the richest indicators for correlation because they carry multiple layers of information: who registered them, when, where they are hosted, which certificate they use, how they are structured and how they relate to other domains. Domain registration, especially the pattern used to register them, is one of the most effective correlation points. Criminal groups frequently use the same registrars, the same registration data or the same naming patterns across multiple campaigns. A group that registers domains with variations of the names of financial institutions, always using the same suffix, the same DNS provider and the same time window, can be identified even when each domain individually looks unique. Hosting infrastructure is another relevant correlation point. Domains that share the same server, or that migrated to servers in sequence, frequently belong to the same operation. This cohosting pattern, as it is called technically, makes it possible to track campaigns even when individual domains change frequently. TLS certificates also carry correlatable information. A certificate issued for a suspicious domain may have been generated using the same parameters as certificates of other domains already associated with known campaigns. The certificate authority, the validity period, the organization name and other certificate fields can reveal connections between domains that appear unrelated. ## **Why hashes are the most fragile and the most precise indicator at the same time** Hashes are paradoxical as indicators. On the one hand, they are extremely precise: a hash uniquely identifies a file, with no ambiguity. On the other, they are the easiest indicators to invalidate, because any minimal modification to the file, even the addition of a single byte, generates a completely different hash. Threat groups that distribute malware at scale frequently automate the generation of variants precisely to make hashes useless as a detection mechanism. Each victim may receive a slightly modified version of the same malware, with a different hash, but with identical behavior. Correlation solves part of this problem. Even when individual hashes do not match known indicators, file behavior patterns, such as the operating system APIs it calls, the directories it creates or the network connections it establishes, may match already documented patterns of known malware families. This behavioral analysis, combined with the correlation of other indicators from the same campaign, makes it possible to identify malware with no known signature. In addition, hashes can be correlated with other elements of the attack chain. A malicious file identified on a machine may have been downloaded from a specific URL, which in turn is hosted on a server with a history of use in previous campaigns. This correlation chain turns an isolated hash into a point within a much broader attack narrative. ## **URLs as links in the chain** URLs are frequently underused correlation points. A specific URL may be the download address of a malware sample, the landing page of a phishing attack, the communication endpoint of a command and control server or the destination of data exfiltration. Each of these uses leaves correlatable traces. The structure of the URL can reveal patterns used by the same group in different campaigns. The URL's domain can be correlated with other domains in the same infrastructure. The server that responds to the URL may have a history of use in previous malicious activity. A relevant pattern identified in campaigns that affected Brazilian companies in recent years is the use of legitimate hosting services as intermediaries. URLs hosted on well-known cloud storage platforms, link shortening services or collaboration platforms are used to bypass filters based on domain reputation. Correlating these URLs with other campaign indicators, such as the final destination IPs, communication patterns or associated files, is what makes it possible to identify the malicious use of apparently legitimate infrastructure. ## **Infrastructure as the attacker's identity** One of the most powerful insights that emerges from the systematic correlation of indicators is that a threat group's infrastructure functions as a kind of fingerprint. More sophisticated groups change their indicators frequently, but they rarely change everything at the same time. A group may swap the domains used in a campaign, but keep the same hosting provider. It may change the malware it distributes, but keep the same command and control servers. It may alter the phishing URLs, but keep the same domain registration patterns. These constants, identified through systematic correlation over time, make it possible to attribute activity to specific groups even when the individual indicators are new. It is the difference between tracking what an attacker uses at a specific moment and understanding how they operate consistently. For the defense, this has important practical implications. When a new campaign is attributed to a group that is already being monitored, the accumulated knowledge about that group's infrastructure and patterns makes it possible to anticipate campaign elements that have not yet been technically identified. ## **From correlation to investigative context** Indicator correlation is a tool, not an end in itself. The final objective is not to have a handsome graph of connections among IPs, domains and hashes. It is to answer the questions that matter for the defense: what is happening, who is behind it, what is the real risk to this organization and what to do next. Gotel was built around this premise. Indicator correlation is not presented as a technical exercise, but as the starting point of an investigation. When an analyst expands an indicator in Gotel, what they find is not just a list of other related indicators, but the context that turns that set of signals into an understanding of the threat: who is behind it, what other signals it connects to and what that picture suggests about the risk underway. That is the leap correlation makes possible: from technical noise to actionable intelligence. --- **References** MITRE ATT&CK. Framework of techniques, tactics and procedures of threat groups. Available at: attack.mitre.org RiskIQ / Microsoft Defender Threat Intelligence. Data on infrastructure correlation in advanced threat campaigns. CERT.br / NIC.br. Statistics of Security Incidents in Brazil. Available at: cert.br Febraban (Brazilian Federation of Banks). Banking Security Report, data on campaigns targeting the Brazilian financial sector. *This article covers threat intelligence concepts for informational purposes. The campaign examples and cases described are based on public reports and data available at the time of publication.*