Threat-Hunting Sweep
A hunt with no seed. Instead of starting from an indicator you already have, this surfaces suspicious infrastructure the data itself flags — crowded phishing hubs, shared servers with bad tenants, and look-alike hosting clusters — handing you fresh leads to chase. For the hunter who wants to find what nobody's reported yet.
How it uses the graph
Traverses the threat-intel layer of the graph, in 6 steps:
How it walks the graph6 steps
01Multi-tenant phishing apexes
Surfacing multi-tenant phishing apexes…
threat-intel
02Shared-hosting IPs with malicious tenants
Surfacing shared-hosting IPs with malicious tenants…
threat-intel
03CDN-like apexes
Surfacing CDN-like apexes with a recommendation…
threat-intel
04ASN-scoped multi-tenant phishing apexes
ASN-scoped multi-tenant phishing apexes…
threat-intel
05ASN-scoped shared-hosting IPs with malicious tenants
ASN-scoped shared-hosting IPs with malicious tenants…
threat-intel
06ASN-scoped CDN-like apexes
ASN-scoped CDN-like apexes…
threat-intel
Why each step runs
- 01Multi-tenant phishing apexes. Calls the candidate procedure for apexes hosting many subdomains with threat sources — bulk phishing infrastructure worth hunting first.
- 02Shared-hosting IPs with malicious tenants. Lists IPs hosting many domains where some are flagged — shared blocks where one bad tenant signals a risky neighbourhood.
- 03CDN-like apexes. Flags apexes whose subdomain and cert counts look CDN-like, with a handling recommendation so they aren't mistaken for a single bad actor.
- 04ASN-scoped multi-tenant phishing apexes. When the user supplies an ASN, lists apexes inside that network hosting many subdomains with threat sources — bulk phishing infrastructure to hunt within a specific operator.
- 05ASN-scoped shared-hosting IPs with malicious tenants. When the user supplies an ASN, lists IPs in that network hosting many domains where some are flagged — risky shared blocks scoped to the operator under investigation.
- 06ASN-scoped CDN-like apexes. When the user supplies an ASN, flags apexes in that network whose subdomain/cert counts look CDN-like, with a handling recommendation so shared platforms aren't mistaken for a single bad actor.