Search threat intelligence.
Research IPs, hostnames, URLs and hashes across feeds and passive DNS.
Choose a path into the data
Threat research
Search indicators, follow passive DNS relationships, and inspect internet exposure.
Explore researchResearcher feeds
Explore intelligence published by researchers in the CTIDAO community.
Browse feedsCTIDAO AI
Verified Whales can explore models with complimentary Starter beta access.
Explore AIFollow the evidence
Each entity page brings source assertions, observed relationships, network context, and applicable Exposure data together. An observation is context, not a maliciousness verdict.
Public data example
http://gdopoo-baidu2026730z.014901490149f.com/URL · Malware Delivery URLs
Last observed date unavailable. Open the entity to examine the original evidence and other context.
Researcher feeds
Coverage and content freshness from researcher-owned sources.
Exact URLs observed serving malware.
A continuously updated IP reputation feed built from a distributed network of Fail2Ban agents and SSH, web, and network-service honeypots. It aggregates IP addresses observed in suspicious scanning, exploitation attempts, and other abusive activity.
A community-maintained watchlist of IP infrastructure observed through honeypot telemetry. Historical observations include original tags, hit counts, and first/last-seen dates.
Contribute intelligence
Publish researcher-owned feeds or contribute passive DNS observations when your wallet tier allows it.
Connect your tools
Public REST and MCP reads, with account-aware tools for eligible Holder wallets. AI model credentials are managed separately in CTIDAO AI.
Explore API + MCP →A community powered by CTIDAO
Begin with public research, discover researcher-owned feeds, and build your standing through useful contributions. CTIDAO wallet holdings unlock deeper access; deposited tokens support eligible research and the people behind the data.