Search threat intelligence.
Research IPs, hostnames, URLs and hashes across feeds and passive DNS.
Choose a path into the data
Threat research
Search indicators, follow passive DNS relationships, and inspect internet exposure.
Explore research →Researcher feeds
Explore intelligence published by researchers in the CTIDAO community.
Browse feeds →CTIDAO AI
Verified Whales can explore models with complimentary Starter beta access.
Explore AI →Researcher feeds
Coverage and content freshness from researcher-owned sources.
A community-maintained watchlist of IP infrastructure observed through honeypot telemetry. Historical observations include original tags, hit counts, and first/last-seen dates.
A community-maintained historical collection of malware and malicious infrastructure indicators contributed to CTIDAO.
Follow the evidence
Each entity page brings source assertions, observed relationships, network context, and applicable Exposure data together. An observation is context, not a maliciousness verdict.
Public data example
40.124.115.253IP · Honeypot infrastructure watch
Last observed Oct 19, 2026. Open the entity to examine the original evidence and other context.
A community powered by CTIDAO
Begin with public research, discover researcher-owned feeds, and build your standing through useful contributions. CTIDAO wallet holdings unlock deeper access; deposited tokens support eligible research and the people behind the data.
Contribute intelligence
Publish researcher-owned feeds or contribute passive DNS observations when your wallet tier allows it.
Connect your tools
Public REST and MCP reads, with account-aware tools for eligible Provider wallets. AI model credentials are managed separately in CTIDAO AI.
Explore API + MCP →