Investigate an indicator.
AMY combines passive provider lookups with attributable real-time web, TLS, browser-runtime, sandbox, and vulnerability evidence.
IOC lookups use configured intelligence providers. Web assessment performs non-invasive HTTP and TLS checks, response and signature fingerprinting, and isolated browser-runtime observation. Sandbox results are provider reports, and CVE correlation only uses exact verified versions. Each result keeps its source, mode, timestamp, and confidence so analysts can review the evidence instead of treating a score as a verdict.
Investigation results
SAMPLE REPORTIllustrative data203.0.113.42Review the flagged evidence and its source context.
Detection summary
BY SOURCEProvider scores describe different signals and are not combined into a probability.
Infrastructure context
- NetworkVirusTotal
- 203.0.113.0/24 (documentation)
- Network ownerVirusTotal
- Example Network · fictional
- Usage typeAbuseIPDB
- Data center · fictional
- Distinct reportersAbuseIPDB
- 38 · sample
- Reports in last 90 daysAbuseIPDB
- 247 · sample
Intelligence sources
5/6 applicable sources completedVirusTotal report
Multiple engines flagged this sample indicator as malicious.
Context & metadata
- Network
- 203.0.113.0/24 (documentation)
- Network owner
- Example Network · fictional
Detection evidence 2
Findings reported by intelligence sources
| Engine / signal | Finding | Observed |
|---|---|---|
| Example engine A | Malicious · command and control | Sample data |
| Example engine B | Malicious · malware | Sample data |