FEATURES
One console for the whole hunt.
Etugen classifies, scores, geolocates and connects everything it collects, puts it in front of your analysts in one place, and warns you when any of it is aimed at you.
THREATS
Live malicious infrastructure.
A feed of malicious IPs and hosts that never goes stale. Every entry is categorized, geolocated and scored from 0 to 100.
- Sort and filter by a 0–100 risk score
- Pivot from one indicator to the operator’s wider estate
- Page through millions of rows without slowing down
192.0.2.14 · Germany
TRASHPILE
The files attackers leave behind.
Malware, credentials, configs, source code and tooling recovered from attacker infrastructure.
- Browse by host, or search every file we hold
- Each server’s layout analyzed and categorized by the operation it supports
- Jump from an indicator straight to the file it came from
LOOT
Indicators pulled out of the files.
Exfiltration endpoints, C2 configs, API keys and private keys, extracted from what attackers leave behind and searchable as indicators.
- Exfiltration endpoints
- C2 hosts and ports tied to live tooling
- Cloud credentials and private keys, surfaced before they are traded
drop.exfil-cdn[.]net/up
198.51.100.3:8443
AKIA••••••••7Q2M
id_rsa · 4096-bit
drop.exfil-cdn[.]net/up
198.51.100.3:8443
AKIA••••••••7Q2M
id_rsa · 4096-bit
drop.exfil-cdn[.]net/up
198.51.100.3:8443
AKIA••••••••7Q2M
id_rsa · 4096-bit
drop.exfil-cdn[.]net/up
198.51.100.3:8443
AKIA••••••••7Q2M
id_rsa · 4096-bit
discord[.]com/api/webhooks/••••
58••••••:AAH••••
mailer@••••[.]ru
s3://backup-••••
discord[.]com/api/webhooks/••••
58••••••:AAH••••
mailer@••••[.]ru
s3://backup-••••
discord[.]com/api/webhooks/••••
58••••••:AAH••••
mailer@••••[.]ru
s3://backup-••••
discord[.]com/api/webhooks/••••
58••••••:AAH••••
mailer@••••[.]ru
s3://backup-••••
YARA
Your rules, run against the attacker’s files.
Add your own YARA rules and Etugen scans every file it collects. See which hosts matched and where they are, and get an alarm when a new match lands.
- Bring your own YARA rules
- Matches mapped by host and country
- An alarm for every new match
EARLY WARNING
Alarms that fire first.
Block the scan before it starts
Watch your domains and IP ranges.
- Your domain shows up in an attacker’s mass-scan list
- Etugen alarms with the staging IPs and the exploit in play
- You block them before the first request lands
Rotate keys before they are used
Watch your domains, email patterns and key prefixes.
- A key or login for your organization surfaces
- Etugen alarms with where and when it appeared
- You rotate it before it is traded or abused
See new infrastructure as it goes up
Watch actors, campaigns or saved queries.
- New C2 linked to an actor you follow comes online
- Etugen alarms while it is still being set up
- You block or hunt it before it is used
INVESTIGATE
Everything an analyst pivots on.
12 ways into the same picture of attacker infrastructure, and every one is included on every plan.
Indicators
Lookup & pivoting
Look up any IP or domain and pivot in reverse to everything connected to it.
IP enrichment
Every IP comes back with ASN, hosting provider, location, category and a 0–100 risk score, plus the activity seen on it.
DNS history
Passive DNS for any domain or IP: what resolved where, and when it changed.
Certificate data
TLS certificates and the hosts that share them, so one certificate can unmask a whole operation.
Infrastructure
C2 detection
Command-and-control servers identified and fingerprinted as they come online.
Infrastructure correlation
Connect IPs, domains, certificates and files into one picture of an operator’s estate.
File structure analysis
Etugen analyzes how attackers lay out their servers, from payloads and tooling to configs and stolen data, and categorizes each one by the operation it supports.
Threat actor profiles
The actors behind the infrastructure: their tooling, habits, campaigns and the hosts they run.
Files & exploits
Deep File Search
Query the full contents of every file Etugen holds, with field-based AND queries.
YARA scanning
Run your own YARA rules across every file Etugen holds and see where matches turn up on the map.
Vulnerability intelligence
See which CVEs attackers are preparing to exploit, and which exploits are already staged.
SQL Sandbox
Run read-only SQL against the data, right in the browser.
WATCH & AUTOMATE
And everything around the hunt.
Alarms
Watch an indicator, domain or saved query and get an email when something new matches.
Domain watch
Get an alarm when your domains or IP ranges show up in an attacker’s target list.
Credential watch
Keys, tokens and logins tied to your organization are flagged as soon as they surface.
Workspaces
Private case folders and bookmarks for the hosts, files and IOCs you are tracking.
API & MCP
Key-based access for your SOAR, TIP or in-house tooling.
Multi-tenant by design
Each organization’s data is isolated. The security architecture is shared under NDA.
GET ACCESS
See the modules on your own data.
Every plan includes every feature, starting with Free.
View pricing Get access