ClusterHawk is a threat infrastructure analysis platform built for cybersecurity professionals to find, profile, and track malicious infrastructure using machine learning.

How does IP clustering work?

ClusterHawk uses ensemble clustering algorithms to analyze IP address patterns, identify relationships, and generate threat intelligence automatically.

What subscription plans are available?

ClusterHawk offers Analyst, Team, Professional, and Enterprise tiers with varying levels of features and analysis capabilities.

How do I submit IPs for analysis?

Upload your IP addresses through the secure Workspace interface. The platform handles datasets up to 5000 addresses per job.

Platform Documentation

Learn how to use ClusterHawk for IP clustering and threat detection

Search Documentation

No results found for ""

Try searching for: clustering, pipeline, model, api, account, dashboard, results, configuration

New to ClusterHawk?

Follow these steps to get started with professional threat intelligence analysis

Submit IPs

Upload your IP addresses of interest through our secure interface. Our platform handles datasets up to 5000 addresses.

Analysis

Our deterministic ensemble pipeline analyzes patterns, identifies relationships, and generates threat intelligence automatically — same input, same clusters, same reasoning, every run.

Receive reports

Get comprehensive threat intelligence reports with IOCs, YARA rules, and hunting queries.

Execute hunting queries

Use our automated hunting query execution service to validate findings and monitor for new threats.

User Guide

Queries Tab

Queries Analysis Tab

The QUERIES tab presents insights from the query analysis component:

Query Patterns: Identifies common patterns in the queries used in your analysis.
Cluster Queries: Shows the specific Shodan queries that define each cluster, helping you understand what characteristics group IPs together.
Real-World Counts: For users with enhanced visualization permissions, displays how many IPs in the current Shodan dataset match each query.
Hunting Queries: For users with hunting query permissions, allows direct execution of queries to see current matches, with real-time IP address lists.
Temporal Comparison: Shows how query results have changed between the original analysis time and current execution, helping identify emerging or declining infrastructure patterns.