Loading…
Every routable page in the threat-intel area — 133 pages across 18 hubs. Search by name, route, or keyword, or filter by category. New pages are added to the home page and the sidebar automatically.
?q=…&cat=…Threat-actor profiles, attribution, DNA, timelines, and APT tracking.
Unified actor browser — MITRE ATT&CK, MISP Galaxy, and platform DB.
/threatintel/actors/directoryopen Posting activity and operational tempo per actor.
/threatintel/actors/timelineopen TTP signatures and infrastructure fingerprints.
/threatintel/actors/dnaopen Search forum handles across 2M+ records.
/threatintel/actors/usernamesopen Attribution framework and analysis.
/threatintel/actors/attributionopen Curated profiles — aliases, countries, malware, TTPs.
/threatintel/actors/catalogopen Visualize actor → actor → IOC connections.
/threatintel/actors/graphopen APT group tracker organised by region — China, Russia, Iran, North Korea, NATO, Middle East, Israel.
/threatintel/apt-trackeropen Top-priority threat actors — LockBit, Cl0p, Scattered Spider, BlackCat, and other high-impact groups.
/threatintel/most-wantedopen Ideology-driven extremist group tracking with indicators and monitoring sources.
/threatintel/extremistsopen Online predator categories, regional risk, and intervention resources.
/threatintel/predatorsopen Active and historical campaigns, attribution, briefings, and assessments.
Active campaign tracker with status, severity, and IOC rollups.
/threatintel/campaigns/activeopen Discovery → exploitation → actions on objectives.
/threatintel/campaigns/lifecycleopen AI-powered campaign generation for tabletop exercises.
/threatintel/campaigns/generatoropen Find connections across campaigns, actors, and IOCs.
/threatintel/campaigns/crossopen Tactical digests with IOCs, severity, and detection guidance.
/threatintel/briefingsopen Live indicator streams, enrichment, C2 tracking, and supply-chain intel.
Real-time IOC feed from 12+ providers — IP, domain, hash, URL.
/threatintel/iocs/liveopen Pivot and enrich any indicator across VT, AbuseIPDB, Shodan, OTX.
/threatintel/iocs/enrichmentopen Structured indicator feeds ready for SIEM, EDR, or CTI ingestion.
/threatintel/iocs/feedsopen Resolve entities across intel sources — actor, malware, campaign.
/threatintel/iocs/entityopen Live C2 infrastructure tracker — Cobalt Strike, Sliver, Mythic, 30+ families.
/threatintel/iocs/c2open Geo-visualization of IOCs by country and ASN.
/threatintel/iocs/mapopen Cross-source IOC correlation — single-feed vs multi-feed confidence.
/threatintel/iocs/crossopen IOC correlation analysis with timeline.
/threatintel/iocs/correlationopen Aggregated feed browser — what each provider ships.
/threatintel/iocs/aggregatedopen Every indicator seen, with provenance.
/threatintel/iocs/observableopen CVE intel, KEV catalog, GitHub advisories, and exploit tracking.
Unified CVE intelligence — NVD + KEV + EPSS + exploit availability.
/threatintel/cves/cvesopen GitHub security advisories with affected versions and patches.
/threatintel/cves/advisoriesopen CVE resource catalogs — patch priority, exploit DB, vendor bulletins.
/threatintel/cves/resourcesopen Malware IOCs, sandbox, sample vault, malicious packages, and family encyclopedia.
Malware IOC feeds across 50+ families.
/threatintel/malware/iocsopen Malware sample vault with hashes and metadata.
/threatintel/malware/vaultopen Hash lookup across 10+ sandbox platforms — consensus verdict.
/threatintel/malware/sandboxopen Malicious package tracking — npm, PyPI, RubyGems, Maven, NuGet.
/threatintel/malware/packagesopen Confirmed supply-chain compromise incidents — npm · PyPI · containers · AI agents. Data: supplychainattack.org.
/threatintel/malware/supply-chainopen Malpedia malware encyclopedia — families, YARA, references.
/threatintel/malware/malpediaopen Maltrail detection trails for known malware.
/threatintel/malware/maltrailopen Feed catalog, sources, quality, scheduler, and reliability tracking.
Feed file browser with format and sample preview.
/threatintel/feeds/catalogopen Feed source registry with enabled/disabled state.
/threatintel/feeds/sourcesopen Feed quality metrics — freshness, accuracy, FP rate.
/threatintel/feeds/qualityopen Feed scheduling and orchestration — cron, retry, backoff.
/threatintel/feeds/scheduleropen Curated threat intelligence feeds from 50+ providers.
/threatintel/feeds/threatfeedsopen My curated threat-intel feed — personal bookmarks and follows.
/threatintel/feeds/mythreatintelopen Operational status, SLO metrics, and NATO Admiralty trust grades for every upstream feed.
/threatintel/source-healthopen Telegram, X/Bluesky, Reddit, and crypto-scam streams.
Multi-platform social media firehose.
/threatintel/social/firehoseopen Tech and AI news aggregation.
/threatintel/social/newsopen Crypto scam feed — wallet addresses, drainers, phishing sites.
/threatintel/social/crypto-scamopen Unified Telegram CTI workspace — free cross-source search, KPIs, and entry points to all Telegram surfaces (leak monitor, IOC pipeline, channel discovery, settings).
/threatintel/telegramopen Telegram Intelligence Hub — 7 tabs: firehose (merged cross-source stream), leak feed, channel search (tgstat-backed), statistics, channel discovery, linked actors (channel → MITRE pivot), and settings.
/threatintel/telegram-monitoropen Telegram-leaked IOCs flowing into the cross-source consensus — hashes, IPs, domains, CVEs, URLs from monitored channels (7-day window).
/threatintel/telegram-iocsopen Dark-web monitoring, ransomware activity, breach forums, and infostealer logs.
Dark-web monitoring dashboard.
/threatintel/darkweb/watchopen Darknet market timelines — Empire, Genesis, Hydra successors.
/threatintel/darkweb/marketsopen Breach forum tracker — posts, threads, user activity.
/threatintel/darkweb/forumsopen DeepDark CTI sources — vetted onion feeds.
/threatintel/darkweb/deepdarkopen Cybercrime ecosystem intelligence — actors, services, pricing.
/threatintel/darkweb/crimeopen Physical Bitcoin attack tracking — wrench attacks, kidnappings.
/threatintel/darkweb/bitcoinopen Infostealer log analysis — credentials, cookies, system fingerprints.
/threatintel/darkweb/infostealeropen Secret and credential leak monitoring across paste sites.
/threatintel/darkweb/leaksopen Breach disclosure feed — official statements and regulatory filings.
/threatintel/darkweb/disclosuresopen Per-group ransomware CTI dossier — TTPs, victims, demands.
/threatintel/darkweb/ransom-reportopen Live ransomware activity feed — new victims, leak posts.
/threatintel/darkweb/ransom-activityopen Ransomware victim geo map — country, sector, group.
/threatintel/darkweb/ransom-mapopen Crypto wallet directory tied to known ransom groups.
/threatintel/darkweb/ransomwhereopen Search .onion sites, look up hidden service metadata, check BTC addresses for abuse, and scan Tor exit nodes.
/threatintel/darkweb/reconopen Authenticated PRO surface — victim stats, recent cyberattacks, negotiations, and YARA packs.
/threatintel/ransomware-liveopen Breach, leak & cybercrime incident tracker from X/Twitter, Telegram, Bluesky & Mastodon firehose.
/threatintel/cyberpulseopen Phish feed, wordlists, scam watch, and email-defense analysis.
Phishing feed aggregation — fresh URLs and lure analysis.
/threatintel/phishing/phishopen Phishing hunting wordlists — brand, gift-card, sextortion, BEC.
/threatintel/phishing/urlsopen Scam watch and monitoring — pig-butchering, romance, investment.
/threatintel/phishing/scamopen Cloud threat landscape, infrastructure intel, web assets, and domain monitoring.
Cloud threat landscape — AWS, Azure, GCP, Kubernetes, SaaS.
/threatintel/infra/cloudopen Infrastructure intelligence — ASN, IP, certificate, hosting pivots.
/threatintel/infra/infraopen Web asset monitoring — external footprint, exposed services, drift detection.
/threatintel/infra/webamonopen Domain monitoring — typosquats, lookalikes, certificate transparency.
/threatintel/infra/domainopen Detection rules, ATT&CK mapping, YARA, and threat signal feeds.
Detection rule catalog — Sigma, YARA, Suricata, KQL.
/threatintel/detections/detectionsopen DISARM red-team framework mapping.
/threatintel/detections/disarmopen YARA rule hub — community and curated rules.
/threatintel/detections/yaraopen Threat-signal RSS feed with auto-classified indicators.
/threatintel/detections/signalopen Research posts, intelligence reports, write-ups, and external research.
Original research reports with IOCs, detections, severity scoring.
/threatintel/research-hub/reportsopen AI-generated research reports from LLM analysis.
/threatintel/research-hub/aiopen Security write-ups and post-mortems.
/threatintel/research-hub/writeupsopen Research-signal feed — what changed since last visit.
/threatintel/research-hub/signalopen RedHunt Labs threat-intel insights.
/threatintel/research-hub/redhuntopen Volexity threat-intelligence posts.
/threatintel/research-hub/volexityopen Individual research post (template page).
/threatintel/research-hub/postopen ATT&CK attack-flow library with reusable patterns.
/threatintel/research-hub/attack-flowopen Knowledge graph of actors, malware, campaigns, IOCs.
/threatintel/research-hub/knowledgeopen Analysis of Competing Hypotheses.
/threatintel/research-hub/achopen Wiki, MITRE ATT&CK, F3EAD, insider threat, OWASP AI, and LLM atlas.
Long-form articles on Telegram OSINT, dark-web monitoring.
/threatintel/wiki/wikiopen MITRE ATT&CK matrix with technique pivots.
/threatintel/wiki/mitreopen F3EAD intelligence workflow framework.
/threatintel/wiki/f3eadopen Insider threat matrix and detection guidance.
/threatintel/wiki/insideropen OWASP AI security landscape and LLM top-10.
/threatintel/wiki/owaspopen MITRE ATLAS — LLM/AI threat atlas.
/threatintel/wiki/llmopen What is covered, data principles, and the analyst-first design intent behind the surface.
/threatintel/aboutopen OSINT frameworks, CLI tools, country map, and curated toolbox.
OSINT framework browser — 70+ tools organized by category.
/threatintel/osint/frameworkopen Curated CLI tools — username, email, domain, social, recon.
/threatintel/osint/cliopen Country-based OSINT map — sources by jurisdiction.
/threatintel/osint/mapopen Curated security toolbox — hand-picked, vetted, well-maintained.
/threatintel/osint/toolboxopen Syberseeker’s start.me hub of free certification tracks — security, cloud, blue team, OSINT, GRC.
/threatintel/osint/certsopen SecOps tools catalog — SIEM, EDR, SOAR, log shippers.
/threatintel/osint/secopsopen AI copilot, MCP search, MISP, STIX, investigations, and watches.
AI copilot — ask, pivot, summarize, draft.
/threatintel/tools/copilotopen MCP (Model Context Protocol) tool search.
/threatintel/tools/mcpopen MISP galaxy and event browser.
/threatintel/tools/mispopen Browse and download STIX 2.1 bundles for OpenCTI, MISP, etc.
/threatintel/tools/stixopen Enrich IPs via IPinfo/AbuseIPDB/Shodan and export as STIX 2.1 bundle.
/threatintel/tools/stix-ip-exportopen Search and filter the CISA Known Exploited Vulnerabilities catalog.
/threatintel/tools/kev-catalogopen Investigation case manager — open, closed, shared.
/threatintel/tools/investigationsopen Watch lists — actor, indicator, keyword, and saved searches.
/threatintel/tools/watchesopen AEAD lifecycle workspaces — Acquire, Enrich, Assess, Deliver.
/threatintel/tools/workspacesopen Boolean search across Telegram messages — AND/OR/NOT, field qualifiers, IOC extraction.
/threatintel/tools/tg-intel-searchopen DDoS intelligence, FortiGate breach check, healthcare breach tracking.
/threatintel/tools/socradar-toolsopen Cross-source search across the entire platform.
/threatintel/tools/unified-searchopen What integrations are wired in and what capability each one unlocks for the platform.
/threatintel/tools/settingsopen External directories, supply-chain intel, and awesome lists.
Off-site cross-references — dashboards, OSINT directories, training labs.
/threatintel/external/externalopen Supply chain intelligence — SolarWinds, 3CX, MOVEit, XZ Utils.
/threatintel/external/supplyopen Curated awesome-security list — vetted, ranked, kept current.
/threatintel/external/awesomeopen Intel dashboard, predictions, metrics, and predictive analysis.
Top-level intel dashboard — key stats, trending, top actors.
/threatintel/predictive/dashboardopen Live 3D globe — 700+ events across 21 layers.
/threatintel/predictive/global-pulseopen Threat-pulse tracking — actor activity, campaign spikes, geo shifts.
/threatintel/predictive/threat-pulseopen Certificate transparency live feed.
/threatintel/predictive/certstreamopen Priority Intelligence Requirements dashboard.
/threatintel/predictive/piropen Ten-panel metrics board.
/threatintel/predictive/metricsopen Platform health, feed reliability, and intel metrics.
/threatintel/predictive/analyticsopen Forward-looking threat predictions with confidence.
/threatintel/predictive/predictionsopen AI-driven threat forecasting from current trends.
/threatintel/predictive/predictiveopen Intelligence analysis workspace.
/threatintel/predictive/analyzeopen Security assessments and risk scoring.
/threatintel/predictive/assessmentsopen Observation dashboard — what is happening right now.
/threatintel/predictive/observeopen Unified tactical SOC view — ransomware, vulnerabilities, and IOC stream panels.
/threatintel/soc-dashboardopen Browser-based live OSINT tools with install, example, and reference URL per tool.
/threatintel/live-centeropen Noise-filtered alert feed, ransomware monitoring, and estate configuration.
Prioritised threat intelligence alerts — noise-filtered, confidence-scored, and matched to your estate.
/threatintel/alertsopen Live ransomware victim and group monitoring with sector/region filtering.
/threatintel/ransomware-liveopen Manage your digital estate — assets, tech stack, sector, and data types for personalised correlation.
/threatintel/estateopen Manage organizations, teams, and member invitations.
/threatintel/org-settingsopen