How to Use?
1. Searching for an IP or Domain
- Enter an IP address or domain in the search bar.
- Click Search to view the intelligence results.
- The results include verdicts, tags, Whois, attack history, passive DNS, certificates, and more.
2. Get Instant Threat Verdicts
Each queried IP or domain receives a verdict indicating its security status:- Malicious – Associated with known threats or attacks.
- Suspicious – Exhibits behavior that may indicate risk.
- Benign – No detected malicious activity.
- Unknown – Insufficient data available.
3.Investigate with Threat Intelligence Labels
Each IP or domain comes with automated intelligence labels that categorize its risk profile.Including but not limited to the following categories:- Threat Attribution: Identifies links to APT groups, botnets, or malware campaigns.
- Infrastructure Role: Determines whether the entity is a C2 server, proxy, VPN, or residential IP.
- Behavioral Insights: Detects use in phishing, DDoS attacks, or credential stuffing operations.
4. Multi-Dimensional Data
ThreatBook CTI aggregates intelligence data to provide a comprehensive view of an address. The available data includes, but is not limited to:- Whois & Registration History – Domain ownership and changes over time.
- Passive DNS (pDNS) – Historical DNS resolutions linking domains and IPs.
- Certificate – SSL/TLS certificate relationships.
- Port Scans & Service Banners – Information from global scanning data.
- Related Malware Files – Identified threats communicating with the address.
- Historical Activity – Previously observed attack methods, targeted ports/services, and connections to other infrastructure.
- Web Search Results – Extracted data from indexed webpages associated with the address.
Accessing Research Data
Currently, ThreatBook CTI Research is accessible through:- Web Interface – Users can perform manual searches via the platform.
- API Integration – Support for automated queries.
- Feeds (Coming Soon) – Continuous intelligence updates for external integration.