Attack-surface mapping
Subdomains, endpoints and exposed services mapped across the whole scope.
Bug bounty & offensive security
We hunt
the bugs
before attackers do.
A researcher collective for attack-surface discovery, manual exploitation and validated reports — built for programs that want signal, not noise.
Demo template[ 2026 ]
Reports by industry professionals
Validated, reproducible, ready to fix.
- Reports filed
- 12,400+
- Valid rate
- 94%
- Median triage
- 9h
- Programs
- 260+
—
How a hunt runs
Recon to validated report — one pipeline with full visibility at every step.
Manual deep testing
Business-logic, access-control and injection classes tested by hand.
Proof & triage
Reproducible steps, impact and a clear fix — ready for your team.
—
Benchmark
Median results across active programs.
| Metric | I1•Hunt | Industry |
|---|---|---|
| Duplicate rate | 6% | 21% |
| Time to first report | 9h | 38h |
| Valid submissions | 94% | 71% |
| Critical found | 1 in 4 | 1 in 11 |
—
From signal to fix
01
Scope
We agree targets, rules of engagement and a severity model.
02
Recon
Continuous mapping of the attack surface within scope.
03
Exploit
Manual validation with a safe, reproducible proof of concept.
04
Report
Triage-ready report with impact, evidence and remediation.
Found something worth fixing?
Tell us about your target — we reply within one working day.
Start a hunt