ClusterHawk is a threat infrastructure analysis platform built for cybersecurity professionals to find, profile, and track malicious infrastructure using machine learning.

How does IP clustering work?

ClusterHawk uses ensemble clustering algorithms to analyze IP address patterns, identify relationships, and generate threat intelligence automatically.

What subscription plans are available?

ClusterHawk offers Analyst, Team, Professional, and Enterprise tiers with varying levels of features and analysis capabilities.

How do I submit IPs for analysis?

Upload your IP addresses through the secure Workspace interface. The platform handles datasets up to 5000 addresses per job.

Platform Documentation

Learn how to use ClusterHawk for IP clustering and threat detection

Search Documentation

No results found for ""

Try searching for: clustering, pipeline, model, api, account, dashboard, results, configuration

New to ClusterHawk?

Follow these steps to get started with professional threat intelligence analysis

Submit IPs

Upload your IP addresses of interest through our secure interface. Our platform handles datasets up to 5000 addresses.

Analysis

Our deterministic ensemble pipeline analyzes patterns, identifies relationships, and generates threat intelligence automatically — same input, same clusters, same reasoning, every run.

Receive reports

Get comprehensive threat intelligence reports with IOCs, YARA rules, and hunting queries.

Execute hunting queries

Use our automated hunting query execution service to validate findings and monitor for new threats.

User Guide

Overview

Pre-Built Models Overview

ClusterHawk provides a collection of pre-trained models ready to use for immediate threat detection and IP analysis. These models are trained on extensive datasets and optimized for specific threat detection scenarios, so you can start advanced analysis without training your own models.

Benefits of Pre-Built Models

Immediate Deployment: Start using advanced threat detection without waiting for model training
Curated Training Data: Models trained on carefully selected datasets representing real-world threat scenarios
Regular Updates: Models are continuously updated with new threat intelligence and attack patterns
Proven Performance: Validated against known threat datasets and real-world attack scenarios
No Resource Requirements: Use without consuming your model storage quota

How to Use Pre-Built Models

Pre-built models can be used in two ways:

Direct Analysis: Select a pre-built model when submitting a prediction job in the Workspace
API Integration: Use pre-built models through the public API for automated threat detection workflows

All pre-built models include detailed documentation about their training data, performance metrics, and recommended use cases to help you choose the most appropriate model for your analysis needs.