Datacenter Infrastructure & Identity Attacks

This report analyzes identity attack origins and detection blind spots, asserting that defenders must treat IP "location" across three dimensions: geography, technology (VPN/proxy), and datacenter infrastructure. Based on large-scale telemetry, the authors found many initial access events originate from datacenter IPs without explicit VPN/proxy tags, and recommend using Autonomous Systems and provider abuse potential to distinguish benign from suspicious datacenter activity, significantly reducing missed initial access while maintaining low false positives.