A computer-implemented method, the method comprising: accessing an instance of an activity in a computing environment, wherein the instance of the activity comprises an attribute set; receiving the instance of the activity at a malicious activity model that comprises a plurality of multi-attribute cluster-identifiers associated with previous instances of the activity, the multi-attribute cluster-identifiers comprising corresponding risk scores and attribute sets, the risk scores and the attribute sets indicate a likelihood that the instance of the activity is a malicious activity, wherein the risk scores are calculated based each of the following: a suspicion score, an anomaly score, and an impact score, each based on information from the cluster that is indicative of malicious activity, wherein the suspicion score is based on information about a tenant of the computing environment, wherein the anomaly score is based on information regarding the sender of information, wherein the impact score is based on a position of individuals targeted by instances of the activity in a corresponding cluster, classification of content in the corresponding cluster, and website information included in the previous instances of the activity, determining, using the malicious activity model, that the instance of the activity is a malicious activity based on comparing the attribute set of the instance of the activity to the plurality of multi-attribute cluster-identifiers, wherein the attribute set of the instance of the activity matches an attribute set of at least one of the plurality of multi-attribute cluster-identifiers, a risk score and the attribute set of the at least one of the plurality of multi-attribute cluster-identifier indicate a likelihood that the instance of the activity is a malicious activity; and generating a visualization of malicious activity operations data comprising the instance of the activity, wherein the visualization identifies the instance of the activity as a malicious activity. accessing an instance of an activity in a computing environment, wherein the instance of the activity comprises an attribute set; receiving the instance of the activity at a malicious activity model that comprises a plurality of multi-attribute cluster-identifiers associated with previous instances of the activity, the multi-attribute cluster-identifiers comprising corresponding risk scores and attribute sets, the risk scores and the attribute sets indicate a likelihood that the instance of the activity is a malicious activity, wherein the risk scores are calculated based each of the following: a suspicion score, an anomaly score, and an impact score, each based on information from the cluster that is indicative of malicious activity, wherein the suspicion score is based on information about a tenant of the computing environment, wherein the anomaly score is based on information regarding the sender of information, wherein the impact score is based on a position of individuals targeted by instances of the activity in a corresponding cluster, classification of content in the corresponding cluster, and website information included in the previous instances of the activity, determining, using the malicious activity model, that the instance of the activity is a malicious activity based on comparing the attribute set of the instance of the activity to the plurality of multi-attribute cluster-identifiers, wherein the attribute set of the instance of the activity matches an attribute set of at least one of the plurality of multi-attribute cluster-identifiers, a risk score and the attribute set of the at least one of the plurality of multi-attribute cluster-identifier indicate a likelihood that the instance of the activity is a malicious activity; and generating a visualization of malicious activity operations data comprising the instance of the activity, wherein the visualization identifies the instance of the activity as a malicious activity.