Platform

Threat Actor Profiles

Validin aggregates IOCs and intelligence from malware feeds, DNS telemetry, OSINT sources, and infrastructure scanning, and makes it available as Threat Profiles.

Sign Up Book a Demo
app.validin.com
How it works

The reporting and the infrastructure, in one record

A profile collects what is known about a threat group or malware family: the indicators attributed to it, the open source reporting behind those attributions, and the infrastructure it operates.

Because the indicators sit on top of our own collection, a profile is more than a reading list. Every domain and address in it opens into full DNS and reputation history, so you can see what the actor’s infrastructure is doing now, not only what a report said it was doing then.

  • Identify active and emerging threat groups
  • Investigate the infrastructure associated with an actor
  • Track newly added indicators and research reports
  • Pivot straight into detailed DNS and reputation data
January April August Domains 14 new 9 new 22 new IP addresses 6 new 11 new 8 new Registrar same same same Hosting region same same same Cert issuer same same same Panel response same same same ROTATES PERSISTS SAME OPERATOR, THREE CAMPAIGNS

Assets rotate between campaigns. The practices in the profile hold.

Sources

Built from multiple intelligence sources

Profiles are assembled from DNS telemetry, OSINT feeds, and threat research databases, alongside Validin’s own collection and infrastructure scanning. Where a well-known source has named a group, the profile carries that name and the reference behind it.
J F M A M J J A S O N D Campaign A Campaign B Campaign C NEW REGISTRAR NEW HOSTING REGION

Indicator activity for one group, quarter by quarter.

Browse the profiles

See how profiles fit an actor-tracking workflow in our threat actor research use case.

Sign up free

Related Use Cases

Actor research Threat Actor Profiles Maintain a continuous picture of an adversary, drawn from many overlapping open source threat reports. Attribution Campaign Attribution Connect scattered domains, addresses, and hashes to one campaign, using overlaps across many independent data sources.

Explore All Features

Feature Core Search The primary entry point for infrastructure data across the platform. Feature Advanced Search Query multiple data sources at once with the Validin Query Language. Feature Projects Collaborative workspaces for grouping, analyzing, and tracking indicators. Feature YARA Rules Develop, test, and execute YARA rules across global web infrastructure. Feature Active Scanning Analyze a website in real time from one or more geographic locations. Feature Bulk Enrichment Check multiple indicators simultaneously, from a list or a whole report. Feature Lookalike Domains Find domains visually or structurally similar to your brand or keyword. Feature API Access Ingest, analyze, and enrich indicators at scale from your own tooling.

Get in touch

Contact us

Validin is the first tab I open every morning.
Senior Analyst, Financial Services IT Company