Search threat intelligence.
Research IPs, hostnames, URLs and hashes across feeds and passive DNS.
Choose a path into the data
Threat research
Search indicators, follow passive DNS relationships, and inspect internet exposure.
Explore researchResearcher feeds
Explore intelligence published by researchers in the CTIDAO community.
Browse feedsCTIDAO AI
Verified Whales can explore models with complimentary Starter beta access.
Explore AIFollow the evidence
Each entity page brings source assertions, observed relationships, network context, and applicable Exposure data together. An observation is context, not a maliciousness verdict.
Public data example
3.147.122.184IP · Honeypot infrastructure watch
Last observed Nov 1, 2026. Open the entity to examine the original evidence and other context.
Researcher feeds
Coverage and content freshness from researcher-owned sources.
A community-maintained watchlist of IP infrastructure observed through honeypot telemetry. Historical observations include original tags, hit counts, and first/last-seen dates.
A continuously updated IP reputation feed built from a distributed network of Fail2Ban agents and SSH, web, and network-service honeypots. It aggregates IP addresses observed in suspicious scanning, exploitation attempts, and other abusive activity.
URLs extracted from public APKs analysed on apkintel.io URLs may or may not be malicious
Contribute intelligence
Publish researcher-owned feeds or contribute passive DNS observations when your wallet tier allows it.
Connect your tools
Public REST and MCP reads, with account-aware tools for eligible Holder wallets. AI model credentials are managed separately in CTIDAO AI.
Explore API + MCP →A community powered by CTIDAO
Begin with public research, discover researcher-owned feeds, and build your standing through useful contributions. CTIDAO wallet holdings unlock deeper access; deposited tokens support eligible research and the people behind the data.