Threat intelligence modules & options

The Threat Intelligence search type exposes six Modules in the captured build, split across two data sources: three on HudsonRock infostealer data and three on SpamHaus reputation data. All six are single-purpose Modules — this search type does not offer OneScan. For the composer flow that surrounds these Modules, see Threat intelligence search: overview.

The Threat Intelligence Module grid showing the Computer/IP Threat tile selected with a coral-orange border, alongside the IP Reputation, Domain Reputation, Email Threat, Domain Threat and Malware URLs tiles

The Modules

Module	data source	Input	Cost / cost type	What it does
Computer/IP Threat (Data: HudsonRock) (selected by default)	HudsonRock	IP address (+ a Compromised Since year)	Free (0 Credits)	Checks an IP for infostealer compromise and threat indicators such as malware, botnets and malicious activity
Email Threat (Data: HudsonRock)	HudsonRock	Email (inferred)	Not captured — see caution	Threat analysis for an email via HudsonRock infostealer data
Domain Threat (Data: HudsonRock)	HudsonRock	Domain (inferred)	Not captured — see caution	Threat analysis for a domain via HudsonRock infostealer data
IP Reputation (Data: SpamHaus)	SpamHaus	IP address (inferred)	Not captured — see caution	Reputation and blocklist check for an IP via SpamHaus
Domain Reputation (Data: SpamHaus)	SpamHaus	Domain (inferred)	Not captured — see caution	Reputation and blocklist check for a domain via SpamHaus
Malware URLs (Data: SpamHaus)	SpamHaus	URL (inferred)	Not captured — see caution	Checks a URL against the SpamHaus malware-URL database

HudsonRock Modules

The three HudsonRock Modules run against HudsonRock infostealer data — records drawn from information-stealing malware logs, used to determine whether a machine or identity tied to an identifier has been compromised. For what this data source is and returns, see HudsonRock.

Computer/IP Threat

Computer/IP Threat is the lead Module and is pre-selected when you open the Threat Intelligence search type. Its tile is drawn with a coral-orange highlighted border.

• Purpose: checks an IP address for infostealer compromise and threat indicators — malware, botnets and malicious activity — via HudsonRock infostealer data.
• Input: an IP address, plus a Compromised Since year field.
• Cost: the line beneath the input reads “Cost per search: Free” — the Module consumes no Credits per search.

Email Threat

Email Threat runs threat analysis for an email address against HudsonRock infostealer data — a check for whether the email appears in infostealer logs.

Domain Threat

Domain Threat runs threat analysis for a domain against HudsonRock infostealer data.

SpamHaus Modules

The three SpamHaus Modules run against SpamHaus reputation data — IP and domain reputation intelligence together with malware-URL blocklists. For what this data source is and returns, see SpamHaus.

IP Reputation

IP Reputation checks an IP address against SpamHaus reputation and blocklist data.

Domain Reputation

Domain Reputation checks a domain against SpamHaus reputation and blocklist data.

Malware URLs

Malware URLs checks a URL against the SpamHaus malware-URL database.

Inputs and costs

Caution

Only the default Computer/IP Threat Module’s Cost per search was captured (Free). The costs of the other five Modules — Email Threat, Domain Threat, IP Reputation, Domain Reputation and Malware URLs — were not captured in the reference build. Confirm the Cost per search line shown on-screen before running any of them.

Caution

Only the default Computer/IP Threat Module’s input was directly observed — an IP address plus a Compromised Since year. The inputs listed for the other five Modules (email, domain, or URL) are inferred from the Module names and were not directly captured, and the exact field labels and placeholders for all six Modules were not captured. Verify the on-screen input before you run.

OneScan and per-search options

Caution

In the captured build the Threat Intelligence search type shows no OneScan Module, no Choose Data Source configuration modal, and no per-search filters or entity-type tabs. The six Modules run on their own, each against a single data source (HudsonRock or SpamHaus). This differs from search types such as Username Intelligence or Public Leaks, where OneScan and a Choose Data Source modal are available. See OneScan explained for how OneScan and its Choose Data Source filters work where they are offered.

Per-tile controls

Caution

Per-tile affordances on the Threat Intelligence Module grid — help icons, tutorial icons, or per-Module gear (settings) icons — were not captured for this search type, so none are asserted here. Check the tiles on-screen for any such controls.

See also: Threat intelligence search: overview and Reading Threat intelligence results.

Verified against UserSearch v2.0.20