Threat Hunting at Scale: Explore 10.6B URLs to Find Payloads, C2s, and Exposed Assets with URLx

URLx expands to 10.6 billion URLs with richer SQL and domain-search filters; a walkthrough maps DPRK-linked compromised WordPress paths using API and SQL queries.

Part 4 of the Cobalt Strike series: automating the C2 feed via API—normalizing indicators into core, network and endpoint outputs for SIEM, IDS/EDR and sandbox pipelines.

Part 2 of the Cobalt Strike series: ten-plus HuntSQL recipes for detecting, grouping and tracking C2 infrastructure by certificate reuse, beacon traits and enrichment—from real hunting scenarios.

A beginner's guide to hunting exposed C2 panels—Supershell, HookBot, Chaos RAT, UnamWebPanel, Metasploit and Mythic—using URL paths, titles, favicon hashes and HuntSQL datasets.

Hunt 2.5 adds a Pivots table tying IPs to certificate subjects, hashes, and TLS fingerprints, 50+ certificate fields in HuntSQL, an Add to Query button, and a downloadable phishing feed.

Hunt 2.4 adds automatic archive extraction in AttackCapture, dozens of new HTTP/HTML fields in the httpv2 HuntSQL table, IOC Hunter filters, and a phishing kit details page.