🔐 Operational Security theater

Monitors the anonymization and obfuscation infrastructure adversaries rely on for operational security: Tor, VPNs, proxies, bulletproof hosting and fast-flux networks. Surfaces OPSEC failures and infrastructure reuse that enable attribution and de-anonymization.

🏹 Threat Actors

🧭 Intelligence disciplines

📚 Priority sources & datasets

🔄 Live Datasets & APIs (2 key-free · ingestible)

📜 Operational Security Playbook

1. Collect Tor exit/relay lists, known VPN and residential-proxy ranges, and bulletproof-hosting ASNs from public and abuse feeds.
2. Cluster indicators by ASN, registrar, TLS certificate and hosting reseller to map anonymization infrastructure ownership.
3. Analyze operator OPSEC failures — session token reuse, clearnet leaks, timezone and language artifacts — that bridge anonymous and attributable identities.
4. Attribute infrastructure to specific bulletproof providers or actor tenancy via co-tenancy, payment trails and infrastructure-reuse pivots.
5. Disseminate curated anonymizer/proxy enrichment tags so downstream theaters can weight or exclude noisy anonymized sources.
6. Feed high-confidence bulletproof ranges into blocklists and sinkholes, and escalate persistent hosts for takedown coordination.

⚡ AI Skills & Automation

Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).

🎯 Add to case

🗃 Data Management

🧩 Advanced Capabilities

🔗 Cross-domain pivots

🔄 Data Feeds & Datasets