Search threat intelligence.
Research IPs, hostnames, URLs and hashes across feeds and passive DNS.
Choose a path into the data
Threat research
Search indicators, follow passive DNS relationships, and inspect internet exposure.
Explore research →Researcher feeds
See what each source covers and when its evidence was last updated.
Browse feeds →CTIDAO AI
Use model access or Clankie with an eligible paid Whale membership.
Explore AI →Researcher feeds
Coverage and content freshness from researcher-owned sources.
A community-maintained watchlist of IP infrastructure observed through honeypot telemetry. Historical observations include original tags, hit counts, and first/last-seen dates.
A community-maintained historical collection of malware and malicious infrastructure indicators contributed to CTIDAO.
Follow the evidence
Each entity page brings source assertions, observed relationships, network context, and applicable Exposure data together. An observation is context, not a maliciousness verdict.
Public data example
85.217.140.47IP · Honeypot infrastructure watch
Last observed Oct 17, 2026. Open the entity to examine the original evidence and other context.
Access follows your work
Wallet holdings set your tier. Deposited CTIDAO is your app balance for eligible research and subscriptions. CTIDAO AI plans are separate purchases for Whales.
Contribute intelligence
Publish researcher-owned feeds or contribute passive DNS observations when your wallet tier allows it.
Connect your tools
Public REST and MCP reads, with account-aware tools for eligible Provider wallets. AI model credentials are managed separately in CTIDAO AI.
Explore API + MCP →