CRDF AI · Predictive threat intelligence

See malicious infrastructure before it becomes an incident.

CRDF transforms live URL telemetry, AI scoring, NRD and WHOIS context into intelligence your security team can investigate, enrich and automate.

Malicious URLs Domains NRD WHOIS AI scoring Private feeds
Check an indicator Create a free API account Request private CTI access
29,810,154 malicious URL signals 1,837,426 AI-scored IOCs Latest signal
Malicious URL signals
29,810,154
AI-scored IOCs
1,837,426
AI candidates
1,752,581
WHOIS records
31,597,638
Predictive scoring
Surface emerging infrastructure earlier.
Enriched context
Move from raw IOC to explainable signal.
Operational delivery
Use feeds and APIs inside existing tools.
Governed access
Licensed data with correction workflows.
Intelligence coverage

A living CTI layer, built for investigation and automation.

Combine live malicious evidence with predictive scoring and infrastructure context without stitching together disconnected datasets.

Malicious URL signals
A continuously refreshed knowledge base for lookup, triage, filtering and enrichment.
WHOIS records
Registration and domain context.
AI analyses
Indicators scored by CRDF AI.
AI candidates
Emerging infrastructure candidates.
Confirmed reports
Community and pipeline submissions.
Built for security operations

One intelligence surface. Multiple operational workflows.

Use the same governed dataset for investigation, protection, enrichment and customer-facing security services.

SOC and threat hunting

Prioritize infrastructure and enrich alerts with AI, URL, domain and WHOIS context.

DNS and filtering

Feed blocking and detection pipelines with current malicious and predictive signals.

CERT and CSIRT

Investigate abuse patterns, coordinate remediation and validate indicators faster.

MSSP and vendors

Enrich services and protect customers through scoped, licensed intelligence access.

Public intelligence preview

Recent malicious URL and CRDF AI observations.

8 censored records Latest observation

Complete human verification to reveal the full indicators in this preview.

Indicators are censored by default. Full URLs can contain phishing, malware or other harmful content.
Domain URL Threat class Detected
r**r**o.com http://r**r**o.com/ Malicious:URL URL telemetry
7**d.cc http://7**d.cc/ Malicious:URL URL telemetry
w**-**b**h**d*kaliumall.com http://w**-**b**h**d*kaliumall.com/**rify Malicious:URL URL telemetry
1**.**3*73.226 http://1**.**3*73.226/**n*sh/ Malicious:URL URL telemetry
1**.**3*73.226 http://1**.**3*73.226/*/ Malicious:URL URL telemetry
t**e**a*-ot.org https://t**e**a*-ot.org/ Malicious:URL URL telemetry
h**b**vako.cc https://h**b**vako.cc/ Malicious:URL URL telemetry
t**h**l**y**vingsite.com http://t**h**l**y**vingsite.com/**k*php Malicious:URL URL telemetry
Check a specific indicator Access complete intelligence
Put intelligence to work

Move from a public signal to an operational decision.

Request private CTI for your investigation and protection workflows, create a Community API account, or check one indicator now.

Request private CTI access Explore the API Check an indicator
Scoped access Integration guidance Correction channel