All use cases

Attribution

Campaign Attribution

The relationship between two indicators often sits in a record that has since changed. We keep that history.

Sign Up Book a Demo

Challenge

Indicators that share nothing on the surface

Three indicators from an incident report can appear entirely unrelated. Examined against our extended history, all three share a name server, a certificate, or a response body hash, and those shared attributes define the cluster.
  • Connect indicators with no apparent relationship
  • Read registration and hosting patterns together
  • Distinguish shared-hosting from genuine co-location
SEPARATE INDICATORS SHARED ATTRIBUTES ONE CAMPAIGN domain-a.example domain-b.example 203.0.113.9 Name server TLS cert Body hash 11 hosts REGISTERED IN 3 DAYS

Three starting domains link to eleven hosts with shared historical attributes.

Approach

Every record in our platform is pivotable

Expanding an attribute returns every host that shares it, including hosts absent from your original report. We can answer the question: are these hosts related?

Infrastructure attributes

Shared addresses, name servers, and hosting providers, with granular point-in-time dates/

Registration and certificates

Registrar, certificate issuance, and registration timing, each with the dates it happened.

Response fingerprints

Body hashes, headers, and favicons that show two hosts serving similar content at the same time.

Evidence, not inference

We don't guess if hosts are related: we provide you the evidence to make informed decisions.

In practice

Three domains, one campaign

  1. 01

    Two indicators dead-end immediately

    Both resolve into CDN ranges with thousands of unrelated neighbours.

  2. 02

    The third has a history

    For two weeks it shared an A record with eleven other domains.

  3. 03

    The registration window is the campaign

    All eleven were registered inside three days and served an identical login page.

  4. 04

    None of this is visible in the present

    The IP address is offline and the pages are parked. The retained history is what supports the assessment.

  5. 05

    The work outlives the investigation

    The attributed cluster goes on record. If the same patterns show up again next quarter, you may be looking at something more than a single campaign.

See how far our pivots go

Forty pivots deep in a single session, without opening another tab.

Explore the platform

Platform features behind this use case

Feature Core Search The primary entry point for infrastructure data across the platform. Feature Advanced Search Query multiple data sources at once with the Validin Query Language. Feature Threat Actor Profiles Known threat actors and malware families, including the infrastructure they operate. Feature Projects Collaborative workspaces for grouping, analyzing, and tracking indicators.

Explore other use cases

Enrichment Security Stack Enrichment Deliver context into the SIEM and SOAR so an analyst can judge an alert on the spot. Brand protection Brand Monitoring and Phishing Detection Identify lookalike domains and phishing templates while they are still being staged. Incident response Incident Triage See what a domain resolved to on the day of the incident, from DNS records captured at the time. Intelligence feeds Customized Threat Intelligence Build feeds shaped around the threats your organization and your customers actually face. Actor research Threat Actor Profiles Maintain a continuous picture of an adversary, drawn from many overlapping open source threat reports.

Get in touch

Contact us

Validin is the first tab I open every morning.
Senior Analyst, Financial Services IT Company