ClusterHawk is a threat infrastructure analysis platform built for cybersecurity professionals to find, profile, and track malicious infrastructure using machine learning.

How does IP clustering work?

ClusterHawk uses ensemble clustering algorithms to analyze IP address patterns, identify relationships, and generate threat intelligence automatically.

What subscription plans are available?

ClusterHawk offers Analyst, Team, Professional, and Enterprise tiers with varying levels of features and analysis capabilities.

How do I submit IPs for analysis?

Upload your IP addresses through the secure Workspace interface. The platform handles datasets up to 5000 addresses per job.

Platform Documentation

Learn how to use ClusterHawk for IP clustering and threat detection

Search Documentation

No results found for ""

Try searching for: clustering, pipeline, model, api, account, dashboard, results, configuration

New to ClusterHawk?

Follow these steps to get started with professional threat intelligence analysis

Submit IPs

Upload your IP addresses of interest through our secure interface. Our platform handles datasets up to 5000 addresses.

Analysis

Our deterministic ensemble pipeline analyzes patterns, identifies relationships, and generates threat intelligence automatically — same input, same clusters, same reasoning, every run.

Receive reports

Get comprehensive threat intelligence reports with IOCs, YARA rules, and hunting queries.

Execute hunting queries

Use our automated hunting query execution service to validate findings and monitor for new threats.

User Guide

OVERCAST Model Interpretation

Classification Interpretation

The OVERCAST model was built from 50 validated nation-state IPs that were expanded to approximately 1,900 assets through profile matching across internet scanning data. The RDP tier of the fleet operates predominantly through RouterHosting LLC / Cloudzy (AS14956), a documented Command-and-Control Provider (C2P), and is anchored to the cloudzy.com domain. The non-RDP tier (nginx, Apache / Nextcloud, Home Assistant, OpenSSH) runs on cloud providers (Amazon, Oracle Cloud, DigitalOcean) and is anchored to the duckdns.org dynamic-DNS service. Behavioral clustering decomposed the fleet into deployment profiles based on certificate configurations, TLS negotiation behavior, JARM / JA3 / JA3S fingerprints, encryption stack composition, screenshot states, and geographic provisioning patterns.

When this model predicts a cluster assignment for a new IP, it indicates the IP matches characteristics of infrastructure associated with the OVERCAST fleet, including windows-{City} NetBIOS / certificate naming on the RDP tier,duckdns.org domain footprint on the web / IoT tier, JARM / JA3S fingerprints clustering by service type, and hosting-provider signatures consistent with the tracked C2P ecosystem.

Cluster Quick Reference:

Please log in to view cluster descriptions and detailed model metrics.

Important Considerations for Predictions:

Training Data Context: The model was trained on infrastructure expanded from validated nation-state seed IPs via profile matching. All assets share a consistent fingerprint: certificate naming, JARM signatures, and hosting provider.
What Predictions Mean: When the model assigns a new IP to a cluster, it means the IP matches characteristics of the OVERCAST infrastructure fleet. These IPs fall into a 'matches known malicious infrastructure profile' category that warrants proactive monitoring.
C2P Attribution Complexity: The infrastructure operates through Cloudzy, a C2P provider used by 17+ nation-state groups. Infrastructure fingerprints identify the fleet but not necessarily the specific actor behind it. Multiple unrelated operators may converge on the same provider.