⌂ Home Threat orrery

Threat intelligence

Threat orreryLive threat intelligence from seven feeds, orbiting a dotted Earth Known exploitedCISA's catalogue of exploited vulnerabilities, orbiting their vendors Exploit oddsWhich vulnerabilities to fix first: FIRST's daily exploit scores joined to CISA's catalogue

Detection

YARA labWrite rules and run them against synthetic specimens Entropy labMeasure how random a file looks, then tune a packed-file detector Rename thisName the classes, calls and strings of an obfuscated loader, then extract its config Beacon hunterFind command-and-control beacons hiding in network flow logs by their timing Sigma labWrite detection rules for Windows event logs and tune them against a benign week WannaTryPeel a staged script loader layer by layer without ever running it Phish labTriage a suspicious message by hand, from look-alike links to SPF, DKIM and DMARC

Cryptography

Decrypt thisLearn to decrypt a stealer config, five layers deep Enigma orreryThree rotors in orbit. Set the key sheet and read the traffic Vault labHow an encrypted vault keeps its promise, from key stretching to integrity proofs Curve orreryElliptic curves you can see, from the chord and tangent law to key agreement Signature labWhat a digital signature proves, from Ed25519 to hash-based trees of one-time keys TLS handshakeStep through a TLS 1.3 handshake with real cryptography, from key shares to the wire

Latent space

Latent spaceThe Hitchhiker's Guide observatory: how modern AI works Model workshopTokens, embeddings, attention, sampling and training you can touch Inference labHow a trained model is served: the KV cache, batching, quantisation and the budget Graph labGraph structure as an input to models, from message passing to graph retrieval RAG labRetrieval-augmented generation, measured step by step before anyone blames the model

The Lab: every instrument, one orrery ⟶

Drag the globeHover a body↑↓ Step←→ Turn

THREAT·ORRERY

Live threat intelligence

Snapshot

/

Writeups ⟶ ThreatFox ↗

Newly listed · CISA KEV

SANS Internet Storm Center · Infocon

Written up · quiet this window

Sample indicatorsDefanged · plain text

The threat orrery

About the data

What you are looking at

Each body is a malware family reported to ThreatFox. Size follows the log of its indicator count, and colour follows the threat type that dominates it: gold for botnet command and control, pale gold for payload delivery, cool white for payloads. Busier families sit on inner orbits. The long tail of smaller families is the outer belt, and indicators ThreatFox couldn't tie to a family are the debris in low orbit.

Points on the globe are the countries where command-and-control addresses are registered. Hover or step to a family and its countries light up, with an arc from the body to each one. Families I've written up carry a ring, and the ones quiet in this window wait on the outermost orbit. yes, it's a pew pew map, just an hourly one lol.

A family's card also counts what three other abuse.ch trackers hold on it: URLhaus, MalwareBazaar and SSLBL. On wider screens the bottom corner shows CISA's newest known exploited vulnerabilities next to live telemetry from the SANS Internet Storm Center.

This window

Sources and licences

ThreatFox by abuse.ch, fair use (free for non-commercial use under abuse.ch's terms of use, which cover all five of its feeds used here): indicators, families, threat types. The "recent" export, read hourly.
Feodo Tracker by abuse.ch, fair use: consulted on every run and merged only when it lists a command-and-control server online inside the window.
URLhaus by abuse.ch, fair use: on a family's card, the malware URLs tagged with one of its names that were added or seen online in this window, and how many were online when the feed was built. Counts only: no URL from it appears on this page.
MalwareBazaar by abuse.ch, fair use: the samples first seen in this window whose signature names the family. Counts only: no hash from it appears on this page.
SSLBL by abuse.ch, fair use: the TLS certificates its blacklist attributes to the family, counted over the whole list rather than this window (the card says "all time"). Counts only: no certificate fingerprint appears on this page.
CISA's Known Exploited Vulnerabilities catalog, CC0 1.0: the newly listed readout, its three most recent additions. Each CVE links to its entry in the National Vulnerability Database.
iptoasn.com, PDDL v1.0: IP address to country of registration.
Natural Earth, public domain, via the world-atlas package (ISC): coastlines and country positions.
flag-icons by Panayiotis Lipiridis, MIT: the flag beside a sample IP marks the country where the address is registered. The flags are baked into this page, so showing one makes no request.
SANS Internet Storm Center: the live telemetry readout (Infocon level, daily report volume, most-targeted ports).

Caveats

A country is where an IP address is registered. That doesn't tell you where the operator sits, and cloud and VPS ranges put infrastructure wherever the provider is.
Only IP indicators are placed: ip:port C2s and URLs whose host is a bare IP. Domains, hostname URLs and file hashes carry no location, so they're counted but not plotted.
Every indicator shown here is defanged (hxxp, [.]) and rendered as plain text. Nothing on this page links to live infrastructure.
ThreatFox is community-sourced. A count is what reporters submitted in the window. It doesn't show the full size of any campaign.
URLhaus, MalwareBazaar and SSLBL count toward a family only when the name they use is one of ThreatFox's names or aliases for it (ignoring case, spaces and punctuation). The name also has to be unique in the window. Generic labels such as a bare "RAT" or "CoinMiner" never count. That's why these counts err low, and a family those trackers name differently shows none.
Your browser contacts isc.sans.edu directly for the live telemetry, without cookies or a referrer. The CISA and abuse.ch figures arrive inside this page's own feed. Nothing else leaves this page.