About the threat-intel platform

A live, edge-aggregated threat-intelligence surface by Pranith Jain — Security Analyst: Threat Intel & Security Automation. Built to answer the questions a CTI analyst actually asks, without an account or a vendor portal.

Live, not cached opinion

Feeds are pulled fresh at the edge each visit — ransomware claims, CVE/KEV, IOCs, firehoses.

Reference, verify-first

Every surface is decision-support. Validate indicators in your own environment before acting.

Cross-source by design

Correlation favours indicators seen in 2+ independent feeds — single-feed flags are noisy.

Open + portable

STIX 2.1 export, RSS, JSON — pull what you need into your own pipeline.

What it covers

Live ransomware leak-site claims (multi-tracker, deduped), CVE merged with the CISA KEV catalogue, a malware-sample stream, phishing URLs with brand attribution, defacement and underground-market feeds, and firehoses from Bluesky, Mastodon, Reddit and Telegram. Plus daily/weekly briefings, a ten-panel metrics board, cross-source IOC correlation, actor and MITRE catalogues, and a parsed mirror of the deepdarkCTI index.

Who it's for

CTI analysts, SOC and IR teams, threat researchers and students who want a fast, honest read on what is active right now — and a place to pivot from a single indicator to its cross-source context.

Why I built this

Most live-intel surfaces are gated behind a vendor login or quietly stale. This one fetches upstream feeds fresh at the Cloudflare edge, deduplicates across sources, and stays honest about freshness (a feed-status page shows exactly what is warm). It is reference-grade decision support, never a substitute for your own validation.

Technical stack

Vite + React 18 + TypeScript, statically prerendered, client components
Cloudflare Workers (edge) — per-feed Cache API + KV last-good fallback, scheduled briefing/warm crons
Tailwind CSS; strict CSP; no third-party trackers
~40 upstream sources normalized server-side; STIX 2.1 / RSS / JSON export
Honest degradation — single-source-down tolerance and a public feed-status dashboard

Data sources & disclaimer

Disclaimer

This platform aggregates data from the following sources for reference and decision-support purposes only. Source reliability varies — always validate indicators in your own environment before taking action. The platform does not verify, endorse, or guarantee the accuracy of third-party data.

Backend data sources (32)

Reliability graded per NATO Admiralty Code (A=best, F=unassessed). Risk level indicates how much corroboration is recommended before acting on data from each source.

Ransomlook — Leak-site scraping — ransomware group onion postsOnly claims posted to leak sites

low

ransomware.live PRO — Authenticated API — ransom notes, negotiation logs, victim claims

low

cti.fyi — Leak-site post tracker — victim claims with .onion screenshotsOnly claims posted to leak sites

low

X / FalconFeeds + DailyDarkWeb — Ransomware + breach claims parsed from threat-intel X posts (free text)Heuristic extraction from prose — lower precision; unverified actor claims

medium

CISA KEV — Known Exploited Vulnerabilities — authoritative US govt

low

NVD — National Vulnerability Database — official CVE repo

low

Malpedia — Curated malware family reference (Fraunhofer FKIE)

low

URLhaus — Confirmed malicious URLs (abuse.ch)

low

ThreatFox — Confirmed malicious IOCs with context (abuse.ch)

low

MalwareBazaar — Confirmed malware samples with hashes (abuse.ch)

low

PhishTank — Crowdsourced phishing verification

low

OpenPhish — Curated commercial phishing feed

low

Cert Spotter / crt.sh — Certificate Transparency log search

low

Hudson Rock — Infostealer victim dataOnly infostealer-compromised machines

moderate

LeakCheck — Breach database aggregator

moderate

XposedOrNot — Breach aggregation service

moderate

IPsum — Consensus-scored malicious IPs from 3+ lists

moderate

CINS Army — Active malicious IP list

moderate

Bitwire IP Blocklist — IP blocklist

moderate

MyThreatIntel — Commercial CTI platform

moderate

AbuseIPDB — Crowdsourced IP reputation

moderate

AlienVault OTX — Open Threat Exchange pulses

moderate

VirusTotal — Multi-engine file scanner

low

Telegram Cybersec — Public Telegram channels — IOC drops, leak announcementsQuality varies by channel

high

Telegram Leak Monitor — Auto-scanned Telegram for leaksScanner heuristics produce false positives

high

Reddit Cybersec — 16 cybersec subredditsDiscussion may include unsubstantiated claims

high

X/Twitter Cybersec — Researcher tweets & IOC drops

high

Bluesky Cybersec — Researcher posts (smaller community)

high

AI Copilot Analysis — LLM-generated assessmentMay hallucinate attribution or IOCs

critical

Actor DNA Analysis — AI-driven actor profilingPattern-matching may produce false associations

high

Heuristic CVE→Actor — Keyword-based CVE→actor matchingMatches may be coincidental

high

Predictive Intel — Forward-looking pattern extrapolationNovel TTPs not covered

critical

Open source tools & libraries

ViteReact 18TypeScriptTailwind CSSCloudflare WorkersWranglerLucide ReactReact RouterRechartsLeafletD3 / vis-networkSTIX 2.1NATO Admiralty Codesql.js (WASM)

About the threat-intel platform

Live, not cached opinion

Feeds are pulled fresh at the edge each visit — ransomware claims, CVE/KEV, IOCs, firehoses.

Reference, verify-first

Every surface is decision-support. Validate indicators in your own environment before acting.

Cross-source by design

Correlation favours indicators seen in 2+ independent feeds — single-feed flags are noisy.

Open + portable

STIX 2.1 export, RSS, JSON — pull what you need into your own pipeline.

What it covers

Who it's for

CTI analysts, SOC and IR teams, threat researchers and students who want a fast, honest read on what is active right now — and a place to pivot from a single indicator to its cross-source context.

Why I built this

Technical stack

Vite + React 18 + TypeScript, statically prerendered, client components
Cloudflare Workers (edge) — per-feed Cache API + KV last-good fallback, scheduled briefing/warm crons
Tailwind CSS; strict CSP; no third-party trackers
~40 upstream sources normalized server-side; STIX 2.1 / RSS / JSON export
Honest degradation — single-source-down tolerance and a public feed-status dashboard

Data sources & disclaimer

Disclaimer

Backend data sources (32)

Reliability graded per NATO Admiralty Code (A=best, F=unassessed). Risk level indicates how much corroboration is recommended before acting on data from each source.

Ransomlook — Leak-site scraping — ransomware group onion postsOnly claims posted to leak sites

low

ransomware.live PRO — Authenticated API — ransom notes, negotiation logs, victim claims

low

cti.fyi — Leak-site post tracker — victim claims with .onion screenshotsOnly claims posted to leak sites

low

X / FalconFeeds + DailyDarkWeb — Ransomware + breach claims parsed from threat-intel X posts (free text)Heuristic extraction from prose — lower precision; unverified actor claims

medium

CISA KEV — Known Exploited Vulnerabilities — authoritative US govt

low

NVD — National Vulnerability Database — official CVE repo

low

Malpedia — Curated malware family reference (Fraunhofer FKIE)

low

URLhaus — Confirmed malicious URLs (abuse.ch)

low

ThreatFox — Confirmed malicious IOCs with context (abuse.ch)

low

MalwareBazaar — Confirmed malware samples with hashes (abuse.ch)

low

PhishTank — Crowdsourced phishing verification

low

OpenPhish — Curated commercial phishing feed

low

Cert Spotter / crt.sh — Certificate Transparency log search

low

Hudson Rock — Infostealer victim dataOnly infostealer-compromised machines

moderate

LeakCheck — Breach database aggregator

moderate

XposedOrNot — Breach aggregation service

moderate

IPsum — Consensus-scored malicious IPs from 3+ lists

moderate

CINS Army — Active malicious IP list

moderate

Bitwire IP Blocklist — IP blocklist

moderate

MyThreatIntel — Commercial CTI platform

moderate

AbuseIPDB — Crowdsourced IP reputation

moderate

AlienVault OTX — Open Threat Exchange pulses

moderate

VirusTotal — Multi-engine file scanner

low

Telegram Cybersec — Public Telegram channels — IOC drops, leak announcementsQuality varies by channel

high

Telegram Leak Monitor — Auto-scanned Telegram for leaksScanner heuristics produce false positives

high

Reddit Cybersec — 16 cybersec subredditsDiscussion may include unsubstantiated claims

high

X/Twitter Cybersec — Researcher tweets & IOC drops

high

Bluesky Cybersec — Researcher posts (smaller community)

high

AI Copilot Analysis — LLM-generated assessmentMay hallucinate attribution or IOCs

critical

Actor DNA Analysis — AI-driven actor profilingPattern-matching may produce false associations

high

Heuristic CVE→Actor — Keyword-based CVE→actor matchingMatches may be coincidental

high

Predictive Intel — Forward-looking pattern extrapolationNovel TTPs not covered

critical

Open source tools & libraries

ViteReact 18TypeScriptTailwind CSSCloudflare WorkersWranglerLucide ReactReact RouterRechartsLeafletD3 / vis-networkSTIX 2.1NATO Admiralty Codesql.js (WASM)