ClusterHawk is a threat infrastructure analysis platform built for cybersecurity professionals to find, profile, and track malicious infrastructure using machine learning.

How does IP clustering work?

ClusterHawk uses ensemble clustering algorithms to analyze IP address patterns, identify relationships, and generate threat intelligence automatically.

What subscription plans are available?

ClusterHawk offers Analyst, Team, Professional, and Enterprise tiers with varying levels of features and analysis capabilities.

How do I submit IPs for analysis?

Upload your IP addresses through the secure Workspace interface. The platform handles datasets up to 5000 addresses per job.

Platform Documentation

Learn how to use ClusterHawk for IP clustering and threat detection

Search Documentation

No results found for ""

Try searching for: clustering, pipeline, model, api, account, dashboard, results, configuration

New to ClusterHawk?

Follow these steps to get started with professional threat intelligence analysis

Submit IPs

Upload your IP addresses of interest through our secure interface. Our platform handles datasets up to 5000 addresses.

Analysis

Our deterministic ensemble pipeline analyzes patterns, identifies relationships, and generates threat intelligence automatically — same input, same clusters, same reasoning, every run.

Receive reports

Get comprehensive threat intelligence reports with IOCs, YARA rules, and hunting queries.

Execute hunting queries

Use our automated hunting query execution service to validate findings and monitor for new threats.

User Guide

Storm-0940 Model Interpretation

Classification Interpretation

The Storm-0940 Brute-Force model analyzed confirmed attack IPs and grouped them into distinct infrastructure clusters. All IPs were actively conducting brute-force activity at the time of analysis. Infrastructure characteristics were gathered using SHODAN metadata with timely retrieval. When this model predicts a cluster assignment for a new IP, the prediction indicates the IP matches characteristics of infrastructure the threat actor has used, which falls into a "possibly going to be malicious" category. The model does not answer "is this IP malicious" (that question is answered by the analyst's pre-curation upstream); it answers which previously-observed attacker-infrastructure pattern this IP most resembles, and how strongly.

The recommended workflow is to read the prediction's kind field first: it is the trust gate. confident_match rows are the actionable subset (the model is confident in the cluster attribution). ambiguous_diffuse and ambiguous_split rows mean the model is hedging across multiple plausible attributions; investigate the candidate set as a unit. out_of_distribution rows do not match any trained pattern. Investigate via behavioral evidence and do not rely on the cluster attribution.

Cluster Quick Reference:

Please log in to view cluster descriptions and detailed model metrics.

Important Considerations for Predictions:

Training data context: every IP in the training set was confirmed attack infrastructure at analysis time. Cluster-quality metrics describe infrastructure cohesion, not legitimacy.
What predictions mean: a cluster assignment indicates the new IP matches characteristics of infrastructure this threat actor has used. It does not assert the IP is currently attacking. It only means its surface fingerprint resembles a previously-observed attacker pattern. Treat the assignment as enrichment evidence, not as a verdict.
Confidence threshold: the 80%+ value in the model card is the recommended actionable threshold for the analyst: predictions above it are typically strong enough to elevate alerts in SOAR / SIEM workflows. It is not a hard model-internal cutoff; the prediction contract emits all four kind regimes (confident_match, ambiguous_diffuse, ambiguous_split, out_of_distribution) regardless, and the analyst gates on kind plus confidence together.
Out-of-distribution rows have predicted_cluster and confidence explicitly nulled to prevent silent false positives. The top-1 information is preserved in candidates_json for forensic review.