Using Netlas in Houdin

Introduction

On September 17, 2026, Houdin.io’s AI analyst began with one suspicious indicator from a ThreatFox alert and used Netlas to find the rest. Netlas searches revealed 280 servers associated with CyberStrikeAI, an open-source platform for AI-assisted attacks with its own command-and-control (C2) component.

Quick scanning

On September 17, ThreatFox listed 45.112.206[.]54 as an indicator associated with an AdaptixC2 server running on port 55005.

Checks against reputation sources yielded limited information:

• VirusTotal reported detections from only five antivirus engines.
• AbuseIPDB returned no relevant records.
• AlienVault OTX returned an outdated pulse describing port scanning unrelated to the current activity.

The Netlas connector returned the most interesting data point: 2 open ports

• Port 22: OpenSSH 9.6p1.
• Port 55000: an HTTPS login page titled CyberStrikeAI.

Netlas recorded the page on September 13, four days before ThreatFox added the indicator. A subsequent scan on September 22 showed that the host still served the same page.

At the time of the investigation, these findings confirmed the service name, open port, and accessible login page. None of these details appeared in the reputation sources checked.

The fingerprint

CyberStrikeAI is an open-source platform for AI-assisted attacks that includes its own command-and-control (C2) component. The platform is designed to operate covertly, but its installer includes a feature that makes deployed instances detectable by external observers.

The installer writes the name CyberStrikeAI to the subject field of its self-signed TLS certificate. As a result, every installation contains the same string in the same certificate attribute, whether or not the operator knows about it.

Mesmer Agent, Houdin’s AI analyst, detects this fingerprint and converts it into a search selector. In response to the question, “Who else uses CyberStrikeAI?”, the agent generates the following query for Netlas:

certificate.subject.common_name:"CyberStrikeAI"

Before using the selector, the agent tested two alternatives and compared their results:

• The certificate fingerprint returned only one record, making it too narrow to support an infrastructure-wide view.
• The JARM hash returned approximately 989,000 results, making it too broad to provide useful search precision.

The agent therefore selected the subject.common_name attribute, which contained the persistent string CyberStrikeAI.

Search by certificate and title

The certificate-field query identified 221 servers. A second query targeting the page title found additional CyberStrikeAI instances whose web interfaces used plain HTTP or whose page titles did not match their certificate data.

The two complementary queries covered different deployment configurations and together identified 280 unique servers.

http.title:"CyberStrikeAI"

The agent then grouped the results by country, network, and port.

Two findings deserve particular attention. First, 215 of the 280 servers operated on port 8080, CyberStrikeAI’s standard port. This result indicates that the use of a nonstandard port does not primarily explain why these hosts are absent from threat intelligence databases. Second, the infrastructure spanned a much broader geography than the tool’s origin might suggest. The largest group of servers was located in the United States, not China.

ThreatFox had already registered 15 of the 280 hosts as C2 servers, and AbuseIPDB contained ratings or records for another 18. However, 201 servers appeared in none of the three sources: ThreatFox, AbuseIPDB, or AlienVault OTX. This subset demonstrates how infrastructure-based searches can expand the investigative picture beyond what reputation databases alone reveal.

What Netlas contributed

Reputation-based sources record a host only after someone discovers and flags it. Netlas works differently: it captures observable evidence of exposed infrastructure regardless of its reputation status — open ports, running software, certificates, and the content of response pages.

As a result, 201 of the 280 servers identified did not appear in any reputation-based source. Their pages and certificates, however, were already present in the Netlas dataset.

History instead of a snapshot

ThreatFox added the investigated address to its list on September 17. Netlas, however, had recorded the CyberStrikeAI page on that host as early as September 13 — four days before the ThreatFox entry appeared. At the time of the research this indicator did not appear in any other source.

Scale in two queries

Reputation-based sources primarily show what is already known. Two Netlas queries produced a different result: the certificate query alone returned 221 records, and a second query on the page title brought the total to 280 distinct servers. The agent then grouped the results by open ports, networks and hosting countries. That picture was not assembled manually from multiple sources — it came from the search results and the faceting that followed.

Conclusion

By Netlas’s internet-wide scan data, Houdin expands a single alert into a map of the operator’s infrastructure. This approach enables the identification of servers associated with an attack platform before they appear in any reputation-based threat-intelligence source.

The full research including a deployment timeline derived from certificate issuance dates, detection signatures, and the complete list of 280 IP addresses — is available in the Houdin blog.