Threat intelligence (D4TI)
What our network sees
D4TI turns attack traffic from sources worldwide, captured by D4-operated sensors and corroborated across 32 curated external feeds, into scored threat intelligence: IP reputation, blocklists, and IOC lookups, delivered as an API and TAXII 2.1.
Current malicious activity
Observed across the D4 network in the last hourWhat D4TI is
Threat intelligence with first-party provenance.
D4TI is built on a network of honeypot sensors that D4 deploys and operates, recording real attacks as they happen. Curated external feeds corroborate what the sensors see. Every indicator carries a confidence score, decays as it goes stale, and ships through an API, blocklists, and TAXII collections your tooling already understands.
What the sensors watch
Capabilities
What you get
Sensor network
D4-operated honeypots in the wild.
Honeypots that D4 deploys and operates across common attack surfaces, from SSH to industrial protocols. First-party capture from honeypots we run ourselves.
Scored indicators
Confidence scoring with per-threat decay.
Every indicator carries a confidence score with per-threat decay, so stale intelligence loses weight and drops out of your blocks on its own.
Lookup API
REST lookups for five indicator types.
Query IPs, domains, URLs, hashes, and CVEs over REST, one at a time or in bulk, with GeoIP and ASN enrichment on IPs.
Blocklists
Five formats, thresholded by confidence.
Confidence-thresholded blocklists in plain text, CSV, JSON, Snort, and nginx formats, ready to drop into existing tooling.
TAXII 2.1 delivery
STIX 2.1 for SIEM and TIP integration.
Standards-native STIX 2.1 over TAXII for SIEM and TIP integration, with collections curated by threat type and confidence.
Webhooks and watchlists
Push events as indicators move.
Watch the indicators you care about and get pushed when they move: new indicators, updates, and watchlist hits, filtered your way.
How it works
From attack to feed
01
Capture
Sensors in the field record real attacks. Curated external feeds corroborate every sighting.
02
Score
Every indicator gets a confidence score from source reliability and freshness, decaying by threat type.
03
Curate
Allowlists gate out false positives. License policy controls what can be redistributed.
04
Deliver
Lookup API, blocklists in five formats, TAXII 2.1 collections, and webhooks into your tooling.
Data and feeds
What ships, and how
| Deliverable | What it contains | Formats | Access |
|---|---|---|---|
| IOC lookup | Verdicts with confidence, severity, and threat types. GeoIP and ASN enrichment on IPs. | JSON | REST, single or bulk |
| Blocklists | Indicators above the confidence threshold you choose, refreshed continuously. | plain · csv · json · snort · nginx | HTTP download with ETag caching |
| TAXII collections | STIX 2.1 indicators in collections curated by threat type and confidence. | STIX 2.1 | Any TAXII 2.1 client |
| Webhooks | New and updated indicators and watchlist hits, filtered by type, threat, source, or confidence. | JSON, signed | Push to your endpoint |
| Custom feeds | Your own indicators as a private overlay on lookups, synced manually or from a URL. | txt · csv · json | Owner scoped |
Sources that require attribution are credited in blocklist headers and STIX references. Data that cannot be redistributed never enters customer outputs.
Integration
Drops into what you already run
One API key gets you lookups, blocklists, and TAXII. Keys are scoped, quotas are visible on every response, and downloads are cache friendly, so wiring D4TI into a firewall, SIEM, or abuse pipeline takes an afternoon.
Scoped keys
Sent as X-API-Key or a bearer token, with scopes for lookup, blocklist, and TAXII.
Quotas you can see
Every response carries X-Quota-Remaining and rate limit headers. No guessing.
Cache-friendly downloads
Blocklists honor If-None-Match, so an unchanged list costs you nothing.
$ curl -H "X-API-Key: d4ti_live_…" \ https://ti.d4networks.com/api/v1/lookup/ip/203.0.113.7 { "found": true, "ioc_type": "ip", "value": "203.0.113.7", "threat_types": ["c2", "scanner"], "severity": "critical", "confidence": 88, "risk": 88, "sources": ["feodo", "blocklistde"], "source_count": 2, "tags": ["qakbot"], "first_seen": "2026-05-14T09:21:44Z", "last_seen": "2026-07-02T18:03:10Z" }
Who it is for
Built for the people who run things
Hosting providers
Screen new signups against IP reputation, watch your own address space, and act on abuse before the tickets arrive.
Security teams
Feed your SIEM over TAXII, enrich alerts with lookups, and let watchlists track the infrastructure you care about.
Network operators
Drop confidence-thresholded blocklists into routers and firewalls, in formats your gear already speaks.
FAQ
Common questions
Where does the data come from?
Two places. Honeypot sensors that D4 deploys and operates record attacks firsthand, and 32 curated external feeds corroborate what the sensors see. Every sighting stays tagged with its source.
How is confidence calculated?
Each sighting is weighted by the reliability of its source and how recently it was seen, then combined across sources. Confidence runs 0 to 99 and decays at a rate set per threat type, so a stale phishing report fades in days while a malware hash never does.
Can I report a false positive?
Yes, from the dashboard or the API. Confirmed reports suppress the offending sighting or allowlist the value outright, and they count against the reliability of the source that reported it.
What formats do blocklists come in?
Plain text, CSV, JSON, Snort, and nginx. You choose the confidence threshold, the freshness window, and the threat types. Downloads honor conditional requests, so unchanged lists are free.
Do you resell other people's feeds?
No. Sources that permit redistribution are credited wherever their data appears, and sources that do not are used only for internal corroboration. The sensor network is ours, and that data is first party.
How do I get access?
Talk to our team. We will walk through what you want to consume, set up your plan and keys, and help wire the first integration.