Skip to main content
The Intel lookup page lets you investigate any network entity against the full Flarehawk platform. Open it from the Intel item in the dashboard sidebar (visible once your organization has the Flarehawk Intel add-on).

​
Running a lookup

1

Open Intel

Select Intel in the sidebar. If you don’t see it, your organization doesn’t yet have the add-on — contact [email protected] to enable it.
2

Enter what you want to look up

Type an IP address, ASN, CIDR range, or JA3/JA4 fingerprint into the search box. Leave the type selector on Auto-detect and Flarehawk will infer the entity type, or pick a specific type to be explicit.
3

Read the result

The profile loads as a set of panels, led by the Flarehawk Intel Score. Each panel is described below.

​
Supported lookups

CIDR lookups are bounded to reasonably sized ranges (prefixes of /16 or smaller) to keep results fast and meaningful. For very large networks, look up the ASN instead.

​
Reading the result panels

​
Verdict

The header panel shows the Flarehawk Intel Score (0–100) with a color-coded rating, the entity’s identity (ASN, country, network classification for IPs), and how many distinct organizations have observed it. “Seen across N organizations” is the corroboration that makes platform intelligence stronger than any single perimeter view.

​
Geolocation & network

For IP lookups, this panel shows IPInfo geolocation, ASN, and network classification. When the Max lookup includes Places data, it also shows the venue name (for example an airport or hotel), category, and advertised Wi-Fi SSID, and the map uses those coordinates.

​
Reputation

For IP lookups, this panel combines:
  • AbuseIPDB community abuse confidence, where available.
  • Flarehawk enforcement rate — the share of this entity’s platform traffic that was blocked or challenged.
  • Flarehawk Risk Score (FRS) — Flarehawk’s own machine-learned maliciousness signal, where present.

​
Attack profile

What the entity actually does, aggregated across the platform:
  • Attack categories — e.g. scanning, credential abuse, rate-based attacks.
  • MITRE ATT&CK techniques associated with its activity.
  • WAF breakdown — relative volume of SQL injection, XSS, and RCE attempts.
  • Top targeted paths — the endpoints most frequently hit (only paths corroborated across multiple organizations are shown — see Privacy).

​
Behavioral fingerprint

How to recognize the entity even when it rotates IPs:
  • JA3 / JA4 fingerprints — TLS fingerprints that identify the client tooling.
  • User agents — the most common, cross-corroborated agents.
  • Bot classification — whether the traffic is automated and how it’s categorized.

​
Campaigns

When the entity is part of attack activity that is active across multiple customers right now, the campaign panel lists those campaigns with their attack type, the number of organizations affected, and the networks (ASNs) involved. This is your earliest signal of a coordinated, cross-customer attack.

​
When there’s no cross-customer signal

If a lookup returns external enrichment (geo, ASN, AbuseIPDB) but an empty platform panel, it means the entity hasn’t been observed by enough organizations for Flarehawk to report anonymized intelligence. Flarehawk only surfaces cross-customer data for entities seen by 3 or more distinct organizations. This is a deliberate privacy guarantee, not a gap in coverage — see Privacy & anonymization.
A high Flarehawk Intel Score is a strong reason to investigate or pre-emptively block, but treat it as decision support. Pair it with the attack profile and your own traffic context before automating enforcement.

​
Auditing

Every Intel lookup is recorded in your organization’s audit log with who looked up what and when. Because Intel surfaces platform-wide data, this gives your team an accountable trail of intelligence queries.