ThreatBook CTI
Free cyber threat intelligence portal — IP, domain & file verdicts with APT attribution and an AI co-pilot
Built for the agent-skills supply chain
ThreatBook CTI turns a raw indicator into an authoritative verdict with the evidence behind it — high-fidelity intelligence, noise filtering, and an AI co-pilot, all in one portal.
IP & domain threat identification
Assess the threat level of any IP or domain, pull its historical attack behaviour, and see how the verdict has changed over time.
False-positive noise reduction
Separates legitimate from malicious activity using infrastructure and ownership data — cutting the false positives that flood SOC triage queues.
Centralised intelligence
IP geolocation, SSL certs, current + historical DNS, WHOIS, asset discovery, and linked malware samples — aggregated for one indicator in one view.
AI analysis + CTI Chat
Analyst expertise baked into the models, plus a natural-language co-pilot — ask questions instead of learning a query syntax.
APT group tracking
Proactive tracking of advanced persistent threat groups — attribute infrastructure to an actor, not just a generic "malicious" label.
API enrichment
Pipe high-fidelity verdicts into SIEM/SOAR, EDR, or a homegrown triage workflow on the paid tier — automation-grade, low false positive.
From indicator to verdict
How a single IP, domain, or file hash becomes an actionable decision inside ThreatBook CTI.
Three ways to get it running
Free research portal
Open i.threatbook.io/research and look up IPs, domains, or file hashes ad hoc — no spend, ideal mid-investigation.
- No account spend for limited queries
- Full verdict + verdict history
- Infrastructure pivots (SSL, DNS, WHOIS)
Paid CTI account
Expanded query capacity and additional analysis features for teams running daily threat-hunting and triage.
- Higher query volume
- CTI Chat co-pilot
- Deeper historical + APT context
API enrichment
Wire ThreatBook verdicts into SIEM/SOAR, EDR, and custom triage pipelines for automated alert enrichment.
- Programmatic indicator lookups
- Automation-grade low false positive
- Co-exists with your current stack
What it has found in the wild
APAC offices & coverage
Same-jurisdiction threat-intel for ASEAN and East Asian compliance frameworks.
Common questions
Is ThreatBook CTI free?
There is a free research portal at i.threatbook.io/research for a limited number of ad-hoc queries — ideal for checking an IP, domain, or file hash mid-investigation. Paid accounts unlock expanded query capacity, the CTI Chat co-pilot, and API access for piping verdicts into your own tooling.
What can I look up?
IP addresses, domains, and malicious file samples. For each, the platform aggregates geolocation, SSL certificates, current and historical DNS, WHOIS (for domains), asset discovery data, linked malware samples, and a verdict history showing how the threat assessment changed over time.
How is this different from a free OSINT blocklist?
Two ways. First, fidelity: ThreatBook builds intelligence from continuous global attack monitoring, malware capture, and proactive APT tracking, with rigorous quality control to strip OSINT noise — so verdicts carry far fewer false positives. Second, attribution: it does not just flag an indicator as bad, it links it to a tracked threat actor where possible.
What is ThreatBook CTI Chat?
It is an AI co-pilot built into the platform. Rather than learning a query language, you ask questions in natural language — for example, whether an IP is tied to known APT infrastructure — and get a contextual answer grounded in the underlying intelligence. It applies analyst expertise baked into the models.
How fresh is the intelligence?
ThreatBook refreshes its intelligence at minute-level frequency, sourced from continuous monitoring of global attack activity, large-scale malware capture, and active APT-group tracking. That cadence is what makes the verdicts usable inside automated enrichment, not just manual lookups.
Can I integrate it with my SIEM or SOAR?
Yes, via the paid API tier. Teams typically use it to auto-enrich every inbound alert with a ThreatBook verdict before it reaches an analyst, or to drive SOAR playbook decisions. The low false-positive rate is what makes automated enrichment practical rather than noisy.
Why does ThreatBook's APAC base matter for threat intel?
Threat intelligence is only as good as its collection. As an APAC-headquartered vendor (Singapore, Hong Kong, China, UAE), ThreatBook has strong native visibility into the actors and infrastructure that target APAC organisations — campaigns a US- or EU-centric feed tends to under-weight. For regulated enterprises under MAS TRM, HKMA, or ASEAN PDPA frameworks, same-region collection is a genuine advantage.
Does RECATOOLS get paid to list ThreatBook CTI?
We earn no per-click fee for this listing and our editorial coverage is independent. In the interest of full disclosure: an affiliated RECASYS business is an authorised reseller of ThreatBook commercial products, so it earns revenue if you buy a commercial licence through it — the same relationship disclosed on our SafeSkill and Flocks listings. ThreatBook CTI's free research portal stays free regardless of how you reach it.
The full story
What is ThreatBook CTI?
ThreatBook CTI is a Cyber Threat Intelligence platform built for security professionals — analysts, threat hunters, and SOC teams who need to decide, fast, whether an indicator is dangerous. It pairs high-fidelity threat data with AI to close the information gap between "here's an IP/domain/file" and "here's what it is, what it has done, and what to do about it." There is a free research portal at i.threatbook.io/research for ad-hoc lookups, and a full API/enterprise tier for teams that want to wire intelligence into their stack.
The pitch in plain terms: stop pivoting across ten tabs to investigate one alert. Paste the indicator, get an authoritative verdict with the evidence behind it.
What it actually does
ThreatBook frames the platform around three jobs:
1. Threat identification. Analyse an IP address or domain to assess its threat level, pull its historical attack behaviour, and see how the verdict has changed over time. An indicator that was clean last quarter and malicious today is exactly the kind of context a static blocklist can't give you.
2. Noise reduction. Distinguish legitimate activity from genuinely malicious behaviour. The platform uses network-infrastructure and ownership data to filter benign sources and cut the false positives that drown SOC queues — the single biggest time-sink in alert triage.
3. Centralised intelligence aggregation. One place for the data you'd otherwise gather from a dozen sources.
What you get on a single indicator
| Data type | What it tells you |
|---|---|
| IP reputation + geolocation | Threat verdict, location, and the network it lives on |
| SSL certificates | Certs associated with the host — a strong pivot for infrastructure hunting |
| DNS (current + historical) | Passive DNS: what resolved here, and what used to |
| WHOIS (domains) | Registration and ownership signals |
| Asset discovery | Open services and website assets exposed on the host |
| Malicious file samples | Malware seen communicating with the indicator |
| Verdict history | How the threat assessment evolved over time |
AI-powered analysis + CTI Chat
ThreatBook bakes analyst expertise into its models to extract deeper insight than a raw feed, and ships "ThreatBook CTI Chat" — an intelligent co-pilot for security operations. Instead of learning a query syntax, an analyst can ask in natural language ("is this IP associated with any known APT infrastructure?") and get a contextual answer grounded in the underlying intelligence.
Where the data comes from
This is the part that separates real CTI from an aggregated open-source blocklist. ThreatBook's intelligence is built from:
- Continuous monitoring of global attack activity
- Malware capture at scale
- Proactive tracking of APT groups — not just "this IP is bad," but which actor it belongs to
Intelligence is refreshed at minute-level frequency, and rigorous quality control strips the noise that plagues free OSINT feeds. The result is the high-fidelity, low-false-positive verdict that makes the platform usable inside an automated pipeline, not just for manual lookups.
Free vs paid
- Free research portal — i.threatbook.io/research: limited queries, no spend, ideal for ad-hoc IP/domain/file checks during an investigation.
- Paid accounts — expanded query capacity, additional features, and API access for piping verdicts into SIEM/SOAR enrichment, EDR, or a homegrown triage workflow.
Why APAC SOCs should care
ThreatBook is an APAC-headquartered vendor (offices across Singapore, Hong Kong, China, and the UAE). For regulated enterprises in the region — financial services under MAS TRM in Singapore, HKMA cyber-resilience in Hong Kong, and PDPA frameworks across ASEAN — same-region intelligence collection means strong visibility into the threat actors and infrastructure that actually target APAC organisations, rather than a US/EU-centric feed that under-weights regional campaigns. The minute-level APT tracking is the standout for threat-hunting teams who need to attribute, not just block.
How to use it
The fastest way in is the free portal: open i.threatbook.io/research, paste an IP, domain, or file hash from an alert you're investigating, and read the verdict, the verdict history, and the associated infrastructure. If it earns a place in your workflow, the API tier lets you enrich every alert automatically.
Explore the free portal at i.threatbook.io/research or read the product docs at docs.threatbook.io.
Look up your next indicator for free
Open the ThreatBook CTI research portal and check any IP, domain, or file hash — no spend required.
Open ThreatBook CTIRelated News
You may be interested in these recent stories from our newsroom.
-
This week's bugs to patch: a critical OTRS flaw and a Linux root hole on CISA's list
A short, practical read of the week's most urgent vulnerabilities: a critical pre-authentication flaw in the OTRS service-desk platform, and...
-
Threat Brief, Week of 18 May 2026: State-Backed Espionage in Malaysia, a Malware-Signing Takedown, and the Defender Itself Under Fire
Our weekly read of the threat landscape: a state-backed actor ran a bespoke espionage operation against Malaysian government networks, Micro...
-
An LLM Agent Drove This Real Intrusion: Marimo RCE to Database Dump in Under an Hour
On 10 May an internet-exposed marimo notebook was breached through CVE-2026-39987 — and then an autonomous LLM agent took the keyboard. Sysd...