Validin Blog

This July, we enabled a much-requested advanced search feature: network filters. Users can now input CIDRs into any compatible IP field, enabling pivots that previously had to be done manually.

Introduction PacketWatch integrates Validin’s threat intelligence into the PacketWatch WireSight console. This integration includes the Validin Threat Feed, which WireSight checks against every single session for signs of malicious traffic.

Data Collection Upgrades & New Bulk Search Validin is rolling out significant improvements to our data collection pipeline, allowing us to catch much shorter lived infrastructure.

Introduction Group-IB recently published a detailed report on GHOST STADIUM, a phishing kit targeting World Cup fans and ticket buyers:

Takeaways Validin is releasing a beta Python SDK for API-driven enrichment and monitoring workflows. The SDK supports bulk enrichment, Lookalike searches, and campaign tracking at scale.

Key Points Pivots from the November 2025 investigation produced mixed results: IP and simple hash indicators went inactive quickly, while C2-related response fingerprints that track tooling and configuration continued to surface related infrastructure.