Threat LED Defence — a free Threat Intel tool on pranithjain.qzz.io. Browser-side security analysis, no signup required.
This is a free, browser-based threat intelligence platform on pranithjain.qzz.io. No signup required — all processing runs locally in your browser.
Every routable page in the threat-intel area - 137 pages across 19 hubs. Search by name, route, or keyword, or filter by category. New pages are added to the home page and the sidebar automatically.
?q=…&cat=…Threat-actor profiles, attribution, DNA, timelines, and APT tracking.
Analyst briefings — concise reads on campaigns, attribution, and assessments.
Live indicator streams, enrichment, C2 tracking, and supply-chain intel.
Real-time IOC feed from 12+ providers - IP, domain, hash, URL.
/threatintel/iocs/liveopen Pivot and enrich any indicator across VT, AbuseIPDB, Shodan, OTX.
/threatintel/iocs/enrichmentopen Structured indicator feeds ready for SIEM, EDR, or CTI ingestion.
/threatintel/iocs/feedsopen Resolve entities across intel sources - actor, malware, campaign.
/threatintel/iocs/entityopen Live C2 infrastructure tracker - Cobalt Strike, Sliver, Mythic, 30+ families.
/threatintel/iocs/c2open Geo-visualization of IOCs by country and ASN.
/threatintel/iocs/mapopen IOC correlation analysis with timeline.
/threatintel/iocs/correlationopen CVE intel, KEV catalog, GitHub advisories, and exploit tracking.
Unified CVE intelligence - NVD + KEV + EPSS + exploit availability.
/threatintel/cves/cvesopen GitHub security advisories with affected versions and patches.
/threatintel/cves/advisoriesopen CVE resource catalogs - patch priority, exploit DB, vendor bulletins.
/threatintel/cves/resourcesopen Malware IOCs, sandbox, sample vault, malicious packages, and family encyclopedia.
Malware IOC feeds across 50+ families.
/threatintel/malware/iocsopen Hash lookup across 10+ sandbox platforms - consensus verdict.
/threatintel/malware/sandboxopen Confirmed supply-chain compromise incidents - npm · PyPI · containers · AI agents. Data: supplychainattack.org.
/threatintel/supply-chainopen Malpedia malware encyclopedia - families, YARA, references.
/threatintel/malware/malpediaopen Maltrail detection trails for known malware.
/threatintel/malware/maltrailopen Feed catalog, sources, quality, scheduler, and reliability tracking.
Curated threat intelligence feeds from 50+ providers.
/threatintel/feeds/threatfeedsopen My curated threat-intel feed - personal bookmarks and follows.
/threatintel/feeds/mythreatintelopen Reliability scoring for each feed provider - uptime, freshness, accuracy, and NATO Admiralty trust grades.
/threatintel/source-healthopen Joins CISA KEV and EPSS against published detection rules to show which exploited vulnerabilities your SIEM has no rule for.
/threatintel/detection-coverageopen Replicated ThreatCluster feeds - trending clusters, CVEs, exploits, dark-web victims, IOC blocklist, MISP events.
/threatintel/feeds/threatclusteropen ThreatCluster-derived entity profiles - actors, ransomware groups, malware, CVEs, and sectors with frequency charts and a weighted co-occurrence relationship graph.
/threatintel/feeds/threatcluster/entitiesopen Replicated threaticon.com STIX 2.1 catalog - threat-actor profiles, malware family dictionary, ATT&CK detection coverage, and a country-level threat map.
/threatintel/feeds/threaticonopen Public dPhish TAXII 2.1 phishing indicator feed - malicious domains, phishing URLs, sender IPs, phone numbers, and attachment rules with active/revoked status.
/threatintel/feeds/dphishopen Aggregated threat-intel feed from radar.offseq.com - ~40 upstream sources, AI-enriched summaries, KEV correlation and Mirage honeypot exploitation telemetry.
/threatintel/feeds/offseqopen CTIWatch public database - 2M+ IOCs, 400k+ CVEs, 4k+ KEV, 10k+ threat actors, 35k+ victims, with confidence scoring and source attribution.
/threatintel/feeds/ctiwatchopen Phishing & scam domain blacklist (MIT) - curated primary feed with local membership checks, root-domain search, and Pi-hole/AdGuard-ready roots.txt.
/threatintel/feeds/destroylistopen Real-world incidents continuously mapped to MITRE ATT&CK tactic/technique chains - per-kill-chain-stage detection + remediation notes, CVEs, actors, and hunting guidance.
/threatintel/feeds/living-threatopen Free keyless multi-engine malware analysis - live malicious / newly-observed URL feeds plus on-demand IOC reputation lookups.
/threatintel/feeds/malwareanalyzeropen Telegram, X/Bluesky, Reddit, and crypto-scam streams.
Multi-platform social media firehose.
/threatintel/social/firehoseopen Tech and AI news aggregation.
/threatintel/social/newsopen Crypto scam feed - wallet addresses, drainers, phishing sites.
/threatintel/social/crypto-scamopen Unified Telegram CTI workspace - free cross-source search, KPIs, and entry points to all Telegram surfaces (leak monitor, IOC pipeline, channel discovery, settings).
/threatintel/telegramopen Dark-web monitoring, ransomware activity, breach forums, and infostealer logs.
Dark-web monitoring dashboard.
/threatintel/darkweb/watchopen Darknet market timelines - Empire, Genesis, Hydra successors.
/threatintel/darkweb/marketsopen Live Tor site directory from darknetlist.is - 108 sites across 9 categories with up/down status and onion URLs.
/threatintel/darkweb/darknetlistopen Breach forum tracker - posts, threads, user activity.
/threatintel/breach-hub?tab=forumsopen DeepDark CTI sources - vetted onion feeds.
/threatintel/darkweb/deepdarkopen Cybercrime ecosystem intelligence - actors, services, pricing.
/threatintel/darkweb/crimeopen Infostealer log analysis - credentials, cookies, system fingerprints.
/threatintel/darkweb/infostealeropen Secret and credential leak monitoring across paste sites.
/threatintel/darkweb/leaksopen Breach disclosure feed - official statements and regulatory filings.
/threatintel/breach-hub?tab=disclosuresopen Aggregated breach and leak corpus from 6 public trackers - ransomware leaks, data breaches, combo lists.
/threatintel/breach-hub?tab=watchopen Ransomware tracking - activity feed, map, ransomwhere, and negotiation reports.
/threatintel/ransomware-hubopen One search across ransomware victims, sender blocklist, and phishing blacklists.
/threatintel/exposureopen Directory of every tracked ransomware leak site - status, recent victims, and profiles (620 groups).
/threatintel/ransomware-groupsopen Search .onion sites, look up hidden service metadata, check BTC addresses for abuse, and scan Tor exit nodes.
/threatintel/darkweb/reconopen Dark-web research methodology - the AI pipeline, operational realities, OPSEC protocol, and investigator workflow.
/threatintel/darkweb/playbookopen Dark web .onion service monitoring - uptime, content changes, and new service discovery.
/threatintel/onion-watchopen Phish feed, wordlists, scam watch, and email-defense analysis.
Phishing feed aggregation - fresh URLs and lure analysis.
/threatintel/phishing/phishopen Phishing hunting wordlists - brand, gift-card, sextortion, BEC.
/threatintel/phishing/urlsopen Scam watch and monitoring - pig-butchering, romance, investment.
/threatintel/phishing/scamopen Cloud threat landscape, infrastructure intel, web assets, and domain monitoring.
Cloud threat landscape - AWS, Azure, GCP, Kubernetes, SaaS.
/threatintel/infra/cloudopen Infrastructure intelligence - ASN, IP, certificate, hosting pivots.
/threatintel/infra/infraopen Web asset monitoring - external footprint, exposed services, drift detection.
/threatintel/infra/webamonopen Daily campaign intelligence - phishing/malware estate tracking, domain growth, takedowns, infra rotation, emerging clusters.
/threatintel/webamon-dtbopen Daily security-intel digest from the PCMedicalist Intelligence Network - 38+ feeds deduplicated into an 11-layer taxonomy with trust scoring and CVE tracking.
/threatintel/pcmedicalistopen Domain monitoring - typosquats, lookalikes, certificate transparency.
/threatintel/infra/domainopen LLM/AI endpoint honeypot intelligence - attacker categories, top IPs, and attack volume from ai-honeypots.com.
/threatintel/infra/ai-honeypotopen Campaigns, ATT&CK techniques, trends, and analyst write-ups on LLM-specific abuse.
/threatintel/infra/ai-llm-intelopen Detection rules, ATT&CK mapping, YARA, and threat signal feeds.
Mirrored detection.wiki — 15,957 Sigma/Elastic/Splunk/Kusto/YARA-L/Panther/Sublime rules mapped to 218 ATT&CK techniques, 1,518 Windows providers (103k events), 426 Security-Auditing events, 17 platforms, 6 labs.
/threatintel/detection-wikiopen Detection rule catalog - Sigma, YARA, Suricata, KQL.
/threatintel/detections/detectionsopen DISARM red-team framework mapping.
/threatintel/detections/disarmopen YARA rule hub - community and curated rules.
/threatintel/detections/yaraopen Threat-signal RSS feed with auto-classified indicators.
/threatintel/detections/signalopen Cisco-Talos cognitive artifact intel (MIT) — 26 tiered YARA rules (T1/T2/T3) spotting AI artifacts in malware, 10 family reports, A0–A11 archetypes, edge scanner.
/threatintel/cairnopen Prompt pattern matching (MIT) — 69 .nov rules hunting jailbreaks, injections, and exfiltration prompts with an edge keyword scanner and 4-category taxonomy.
/threatintel/novaopen Taxonomy layer from aisecurity.zone — 8 system divisions, 20 risk identifiers (OWASP LLM01-10 + ASI01-10), cited CVEs joined to KEV. Structure only; deep-links to the original.
/threatintel/ai-playbookopen Evidence-led AI security reference (Apache-2.0) — 9 deterministic rules, 16-kind asset taxonomy, 38 ADRs, plus stateless runtime-activity checks.
/threatintel/denaliopen Research posts, intelligence reports, write-ups, and external research.
Original research reports with IOCs, detections, severity scoring.
/threatintel/research-hub/reportsopen AI-generated research reports from LLM analysis.
/threatintel/research-hub/aiopen Security write-ups and post-mortems.
/threatintel/research-hub/writeupsopen Research-signal feed - what changed since last visit.
/threatintel/research-hub/signalopen RedHunt Labs threat-intel insights.
/threatintel/research-hub/redhuntopen Volexity threat-intelligence posts.
/threatintel/research-hub/volexityopen Individual research post (template page).
/threatintel/research-hub/postopen ATT&CK attack-flow library with reusable patterns.
/threatintel/research-hub/attack-flowopen AI attack-flow visualizer: report URL/text → ATT&CK graph with PNG/STIX/.afb export.
/threatintel/flowvizopen Knowledge graph of actors, malware, campaigns, IOCs.
/threatintel/research-hub/knowledgeopen Analysis of Competing Hypotheses.
/threatintel/research-hub/achopen AI agent-driven research generation - automated threat intelligence briefs and analysis.
/threatintel/research-hub/agenticopen RedHunt Labs research publications - vulnerability disclosures, threat reports, and tool releases.
/threatintel/research-hub/redhunt-labsopen Wiki, MITRE ATT&CK, F3EAD, insider threat, OWASP AI, and LLM atlas.
Long-form articles on Telegram OSINT, dark-web monitoring.
/threatintel/wiki/wikiopen MITRE ATT&CK matrix with technique pivots.
/threatintel/wiki/mitreopen F3EAD intelligence workflow framework.
/threatintel/wiki/f3eadopen BS5055 cyber resilience standard: understand threats, design controls, validate controls.
/threatintel/wiki/threat-led-defenceopen F2T2EA joint targeting cycle (Find, Fix, Track, Target, Engage, Assess).
/threatintel/wiki/f2t2eaopen OODA decision cycle (Observe, Orient, Decide, Act) - the tempo layer under targeting frameworks.
/threatintel/wiki/oodaopen Cyber Kill Chain v2 - the 7-phase chain plus lateral movement and a campaign overlay.
/threatintel/wiki/kill-chain-v2open Unified Kill Chain - 18 phases across In / Through / Out cycles (Pols 2017).
/threatintel/wiki/unified-kill-chainopen Insider threat matrix and detection guidance.
/threatintel/wiki/insideropen OWASP AI security landscape and LLM top-10.
/threatintel/wiki/owaspopen MITRE ATLAS - LLM/AI threat atlas.
/threatintel/wiki/llmopen Registry of AI agent containment failures - indexed by the failed control, with containment chains and guardrail analysis.
/threatintel/ai-escapeopen What is covered, data principles, and the analyst-first design intent behind the surface.
/threatintel/aboutopen Rogue agents, AI incidents, offensive tooling, live vulns, advisories, and NHI identities — one tracking surface.
Tracking hub for AI escape, AI incidents, security-matrix tools, live vulns, advisories, and NHI scanner.
/threatintel/ai-securityopen Daily mirror of incidentdatabase.ai reports — AI harms in the wild, tracked per cite.
/threatintel/ai-incidentsopen Daily mirror of aisecuritymatrix.com — AI-enabled pentest, scanner, MCP, and skill tooling.
/threatintel/ai-security-matrixopen Realtime AI vulnerability tracking — EUVD + NVD + OSV watchlist with KEV overlap and EPSS scoring.
/threatintel/ai-vulnsopen CVE firehose, tool release trains, ExploitDB PoCs, plus Hacktron/Unit42/CSA research.
/threatintel/ai-advisoriesopen OSINT frameworks, CLI tools, country map, and curated toolbox.
OSINT framework browser - 70+ tools organized by category.
/threatintel/osint/frameworkopen Curated CLI tools - username, email, domain, social, recon.
/threatintel/osint/cliopen Country-based OSINT map - sources by jurisdiction.
/threatintel/osint/mapopen Curated security toolbox - hand-picked, vetted, well-maintained.
/threatintel/osint/toolboxopen Syberseeker’s start.me hub of free certification tracks - security, cloud, blue team, OSINT, GRC.
/threatintel/osint/certsopen SecOps tools catalog - SIEM, EDR, SOAR, log shippers.
/threatintel/osint/secopsopen Curated directory of 40 OSINT portals and resources filtered by category.
/threatintel/osint/directoryopen 387 curated CTI links across intel levels, tagged by platform integration status.
/threatintel/cti-bookmarksopen AI copilot, MCP search, MISP, STIX, investigations, and watches.
AI copilot - ask, pivot, summarize, draft.
/threatintel/tools/copilotopen Interactive topology of CVEs, actors, IOCs, sectors, and techniques.
/threatintel/entity-graphopen Vera - AI-powered investigative assistant for threat intelligence workflows.
/threatintel/veraopen Search 1,628+ reports, CVEs, IOCs, briefings, STIX bundles, and knowledge graph via 25 MCP tools on ti-mindmap-hub.com — with a full per-tool reference (names, descriptions, parameters).
/threatintel/mcp-searchopen STIX 2.1 bundle browsing, IP enrichment, and API access.
/threatintel/tools/stix-hubopen Search and filter the CISA Known Exploited Vulnerabilities catalog (tab of CVE Intel).
/threatintel/cves/cves?tab=kevopen Boolean search across Telegram messages - AND/OR/NOT, field qualifiers, IOC extraction.
/threatintel/tools/tg-intel-searchopen DDoS intelligence, FortiGate breach check, healthcare breach tracking.
/threatintel/tools/socradar-toolsopen Cross-source search across the entire platform.
/threatintel/tools/unified-searchopen Curated catalog of 53 security tools organized by category.
/threatintel/tools/directoryopen 42 tools across 13 providers - IP reputation, malware analysis, vulnerability lookup, ransomware tracking, breach intelligence.
/threatintel/tools/darknet-intelopen External directories, supply-chain intel, and awesome lists.
Off-site cross-references - dashboards, OSINT directories, training labs.
/threatintel/external/externalopen Curated awesome-security list - vetted, ranked, kept current.
/threatintel/external/awesomeopen OSINT domain exposure search - exposed paths, staging, misconfigs.
/threatintel/external/cerastopen Infostealer log search - compromised credentials by domain.
/threatintel/external/threatmonopen Intel dashboard, predictions, metrics, and predictive analysis.
Program health, feed reliability, snapshot metrics, maturity, and quick actions.
/threatintel/predictive/dashboardopen Red/cyan/purple panels - ransomware activity, vulnerability index, and IOC stream with consensus scoring.
/threatintel/soc-dashboardopen Live 3D globe - 700+ events across 21 layers.
/threatintel/predictive/global-pulseopen Live breach/leak/intel incident tracker - ransomware, leaks, extortion, supply chain from X, Telegram, Reddit, Bluesky.
/threatintel/cyberpulseopen Threat-pulse tracking - actor activity, campaign spikes, geo shifts.
/threatintel/predictive/threat-pulseopen Certificate transparency live feed.
/threatintel/predictive/certstreamopen Ten-panel metrics board.
/threatintel/predictive/metricsopen Forward-looking threat predictions with confidence.
/threatintel/predictive/predictionsopen AI-driven threat forecasting from current trends.
/threatintel/predictive/predictiveopen Browser-based live OSINT tools with install, example, and reference URL per tool.
/threatintel/live-centeropen Noise-filtered alert feed, ransomware monitoring, and estate configuration.
Real-time APT monitoring across 81 groups, 108 techniques, 39 OSINT feeds with MITRE ATT&CK + Kill Chain mapping — replication of hero-itsme/Global-Threat-Actor-Monitor expanded (40→81 groups, 29→108 techniques, 30→39 feeds).
/threatintel/threat-actor-monitoropen Prioritised threat intelligence alerts - noise-filtered, confidence-scored, and matched to your estate.
/threatintel/alertsopen Live ransomware victim and group monitoring with sector/region filtering.
/threatintel/ransomware-liveopen