Cyber Investigations | Investigate & Attribute Anonymous Threat Actors

Constella Hunter is an intuitive cyber investigation tool that enables you to rapidly investigate and attribute malicious activity, fraud, and potential insider threats. Analyze data from thousands of sources, resolve anonymous activity to real identities and physical locations, and identify unknown connections between threat actors and their activity.​

Read how leading cyber investigative journalist Brian Krebs used Constella Hunter to fight against cybercrime:
Constella’s Role in Fighting Cybercrime: Supporting Investigative Journalism and Law Enforcement

Solve investigations 5X faster

Start with just a single indicator and enrich information from other sources and begin making connections. Hunter delivers real-time and historical identity intelligence that helps you solve investigations 5X faster. Hunter accelerates and simplifies cyber investigations and threat analysis by:

  • Bringing together data from thousands of sources.
  • Providing full customization of the queries to deliver high-value results.
  • Enabling the visualization of intelligence in an easily consumed format.

Comprehensive visibility & intuitive visualizations

Hunter collects data from across the Surface, Deep, and Dark Web, and social media to deliver unmatched visibility of threat actor activity.

Data visualizations enable you to understand links and conduct advanced analysis:

  • Visualize any attributes you have identified from within the platform using the graph workspace.
  • Easily add information to the graph, change the shape, view metadata, and upload/download graphs to other platforms. 

Fast, focused cyber investigation

Focus your investigation using a simple and intuitive search engine. You can search for over 30 different attributes and keywords across multiple sources (either individually or together).

  • Link data from Surface, Deep, and Dark Web and Social Media sources and easily move between them.
  • Search the Constella Data Lake™ to access 66+ billion compromised identity records.
  • Conduct a bulk search, identify related searches, view your search history and investigate domain exposure.

Fluid investigation management

Create multiple investigations and share with colleagues for collaboration. You can build case-specific results, graphs, target packs, and notes, After the investigation’s complete, you have the option of archiving for future access or auditing and deleting when no longer needed.

  • Break down traditional barriers across data silos.
  • Link real identity information to obfuscated identities & malicious activity.
  • Correlate activity across data sources to identify new accounts and data associated with your target.

"With Hunter, we uncovered the real identity of a bad actor that led us to a criminal group selling credentials from our financial institution in a matter of hours, saving us +$100M from identifying fraudulent credit cards.”

- Top 5 Global Bank

Password pivoting

Improve real identification by identifying additional accounts using passwords collected from breaches

Malicious scores

Use ML-produced scoring of entities associated with malicious breaches to gain context into how malicious search terms might be

Total privacy

Completely protect searches from outside detection using our proprietary encryption methods—not even our teams can view which searches are conducted


Configure Hunter to provide proxies to obfuscate your cyber investigation, and use strong audit capabilities to monitor what searches are conducted