Provider Radar: Hosting, Registrar, and Enabler Intelligence

Provider Radar looks at the infrastructure layer underneath attacks: the hosting companies, registrars, and platforms that threat activity rides on. Instead of a single host, you see which providers carry the most malicious activity, which registrars are churning out new domains, and which widely used platforms are being abused as free infrastructure.

It overlays the signals you track elsewhere onto each provider: C2 Infrastructure, AttackCapture open directories, IOC Hunter hosts, and Phishing sites. From a provider you can pivot to the Threat Actors that keep using it, or open any host in Search.

Open Provider Radar from the Hunting group in the sidebar. It has these sub-sections: Host Radar, Registrar Radar, Threat Activity Enablers, and Name Server Radar (marked Soon).

Host Radar

Host Radar browses hosting companies with malicious activity overlaid. The summary table lists each company with its HQ country and counts of C2s, open directories, IOCs, posts, and phishing sites, over a window you set. Open a provider for its detail page, which adds:

• Provider domain, a bulletproof rating, whether it accepts crypto, and known aliases.

• Its ASNs and estimated IPv4 footprint, plus customer name servers.

• Malicious activity over 30 and 90 days: C2s scanned, malicious open directories, IOC IPs, IOC articles, and phishing sites.

This is how you judge whether a provider is a frequent home for abuse, and how concentrated that abuse is.

Registrar Radar

Registrar Radar tracks newly registered domains by registrar over a window. Tabs cover Registrars, TLD stats, Domain search, and Graphs. The registrar table shows domain volume, how many TLDs each one spans, and its top TLDs. Use it to spot registrars and TLDs that cluster with abuse, which helps when you are triaging a freshly registered domain.

Threat Activity Enablers

Enablers pivots from widely abused platforms into provider-level views. Many campaigns hide behind trusted services by using their user-generated content or tenant URL patterns, for example object storage subdomains. Each provider card shows how many known URL patterns and hosts are tied to it. Open one, such as Alibaba Cloud, and you get tabs for IOC Hunter hosts, scanned C2s, open directories, and the abused URL patterns, with the specific suffixes that keep showing up in campaigns.

Name Server Radar

Name Server Radar is marked Soon in the navigation. Document it once it ships.