CULFIG · TALLINN, ESTONIA
Autonomous systems that find, triage, and dismantle malicious infrastructure — before it reaches your people. Sovereign by design, operated from Tallinn.
01 · FIND · SCRAPESMITH
ScrapeSmith drinks from the raw web — certificate transparency, fresh registrations, spam traps — and pushes every URL through a tiered cascade: cheap heuristics first, trained models second, an LLM analyst for the hard residue. Each tier discards the obvious so the next can afford to think.
T0 · heuristics T1 · models T2 · LLM
50K URLs / day · p50 verdict 1.8 s · evidence attached
02 · TRIAGE · PHISHTRIAGE
PhishTriage fingerprints every message — structural signatures, perceptual hashes of rendered pages, embedding space — and collapses thousands of duplicates into a single campaign family. One family, one case, one evidence-first takedown notice that hosts act on the first time.
fingerprint pHash embeddings
FAM-3121 · 14,882 messages → 1 case
03 · RESOLVE · TAKEDOWNS
We draft the abuse case the moment a family is confirmed — hoster, registrar, CERT, all in the loop, every claim backed by captured evidence. We track each notice to resolution and re-verify that dead infrastructure stays dead. Order, imposed on the mess.
notice drafted SLO tracked verified down
registrar SLO 72 h · re-verified daily
CONTACT
For security teams — and for everyone who doesn't have one. We find the infrastructure targeting you and take it down.
info@culfig.com