Airframes.io: Intelligence Source Guide
Airframes.io aggregates decoded aircraft datalink messages - ACARS, VDL Mode 2, HFDL and satellite AERO - from a volunteer receiver...
Signals Intelligence
Radio Callsign: Data Point Intelligence Guide
A callsign is a licensed identity broadcast in the clear. Few identifiers are simultaneously regulated, globally unique and publicly indexed....
IMEI / Device Identifier: Data Point Intelligence Guide
An IMEI identifies a handset, not a person and not a phone number. Confusing device identity with subscriber identity is...
Cell Tower / Cell ID: Data Point Intelligence Guide
A cell identifier is not a location. It is a piece of network infrastructure with a coverage footprint, and confusing...
Malware Family: Data Point Intelligence Guide
A malware family name is an analytical claim, not a fact stamped on the binary. It is the most useful...
SSL/TLS Certificate: Data Point Intelligence Guide
Adversaries change domains and IPs constantly. They reuse certificate configuration because it is tedious not to. That asymmetry makes the...
CVE / Vulnerability: Data Point Intelligence Guide
A CVE identifier is a label for a flaw, not a measure of your risk. Treating the two as the...
File Hash: Data Point Intelligence Guide
A file hash is the cheapest reliable fact in cyber threat intelligence: fixed length, unambiguous, and either it matches or...
TLS / JA3 Fingerprint: Data Point Intelligence Guide
Encryption hides the payload, not the handshake. The way a client says hello is often enough to name the software...
IP Address: Data Point Intelligence Guide
An IP address tells you where traffic went, not who sent it. Treat it as a lead on infrastructure, never...
