Visibility into malicious infrastructure is at the core of today's network defenses. To stay ahead of threats, the community increasingly relies on active investigation, engaging unknown domains and services to detect emerging threats before they take root. However, active investigation introduces the overlooked risk of exposing itself. The very efforts the community makes to gain visibility into malicious infrastructure reveal their vantage points and behaviors to anyone watching. This dissertation quantifies the exposure of active monitors and the risks that exposure creates using DNS as a global lens. Prior work on DNS interception has focused on privacy, censorship, or abuse. In contrast, our novel systems and measurement techniques enable observing DNS monitors from the perspective of an external adversary. We show that network outsiders can remotely discover and characterize active monitors at Internet scale. Through the first Internet-wide study of DNS monitoring to analyze emitter behavior, we uncover monitoring deployments across thousands of networks globally, including vendor relationships and real-time security policy changes. This exposure enables network adversaries to profile the infrastructure supporting monitoring, identify blind spots, and create opportunities for evasion. We argue that monitor exposure and the evasion it enables pose a critical risk to network visibility, as they allow adversaries to hide not only their behavior and content but the infrastructure that supports them. We present the first evaluation of DNS-level evasions, measuring how DNS monitors fare under adversarial conditions, and show that adversaries can manipulate resolutions to evade monitoring and hide their infrastructure. Even simple evasions can degrade the security community's ability to respond while imposing minimal cost to attackers. Our adversarial perspectives demonstrate the need for network defenders to consider the real risk of profiling of systems that provide needed visibility.