AEGLIX INVESTIGATION
Threat Investigation Workspace
Search any indicator. Discover what's known.
URLs, domains, IPv4/IPv6, email addresses and MD5/SHA1/SHA256 hashes. Press Enter to search.
Read-only lookup. This does not visit, scan or block the indicator.
Start with an indicator
Connect public threat-feed evidence with your own saved Guardian scans. Search results include source coverage so you can see what is known and what is missing.
No history for this indicator
This doesn't mean it's safe — it could be new, outside our snapshot, or recorded in a different session.
Submit it to a threat feed:
External searches share the indicator with that service. Blocklist exports do not change your firewall.
- First available evidence
- —
- Latest available evidence
- —
- Your saved scan matches
- —
- Vendors with detections
- —
Coverage and interpretation
Recorded vendor verdicts
Verdicts come from your saved scans. A missing percentage means the vendor did not supply confidence.
| Vendor | Verdict | Confidence | Last checked | Details |
|---|
Vendors reporting detections over time
Distinct vendors per UTC day across your available saved scans. Missing dates are not treated as clean.
Available activity
Source timestamps describe the evidence available here, not a complete history of the indicator.
Sources and confidence
Campaign context
Export this investigation
Reports include the indicator, reputation, relationships, timeline, evidence and coverage limitations. Review before sharing: your saved scan evidence may be private.
STIX can be imported into compatible TAXII tooling. No TAXII server or publishing connection is configured.