NCMEC CyberTipline: Intelligence Source Guide
The CyberTipline is the statutory funnel through which US service providers report apparent child sexual exploitation. Its published statistics are...
URL
Internet Watch Foundation: Intelligence Source Guide
The IWF is the UK's hotline and assessment body for child sexual abuse imagery, and the operator of the industry...
INHOPE Hotline Network: Intelligence Source Guide
INHOPE is the international association of national hotlines that receive public reports of child sexual abuse material and route them...
TLS / JA3 Fingerprint: Data Point Intelligence Guide
Encryption hides the payload, not the handshake. The way a client says hello is often enough to name the software...
DNS Record: Data Point Intelligence Guide
DNS records are an organisation's architecture diagram, published voluntarily and updated in real time. Most defenders never read their own....
Wi-Fi BSSID: Data Point Intelligence Guide
A wireless access point shouts its identifier several times a second, and crowdsourced databases have been listening for years. A...
MAC Address: Data Point Intelligence Guide
A MAC address is the closest thing to a serial number that a network interface broadcasts for free. It is...
IP Range / CIDR: Data Point Intelligence Guide
Individual IPs rotate hourly. The block they come from does not. CIDR is the level at which infrastructure ownership actually...
Subdomain: Data Point Intelligence Guide
Organisations defend the domain they advertise and forget the hundred hostnames beneath it. Subdomain enumeration is where the real attack...
ASN: Data Point Intelligence Guide
The ASN is where infrastructure stops being anonymous. Every packet on the public internet is routed by an organisation that...
URL: Data Point Intelligence Guide
A URL is the only artifact that carries the attacker instruction set in plain sight. Parse it properly and it...
IP Address: Data Point Intelligence Guide
An IP address tells you where traffic went, not who sent it. Treat it as a lead on infrastructure, never...
Domain Name: Data Point Intelligence Guide
A domain name is the cheapest thing an adversary buys and the most expensive thing for them to keep clean....
Disinformation Intelligence (DISINFOINT): Intelligence Discipline Guide
The finding is rarely that a claim is false. It is that a set of accounts, sites and outlets behaved...
Email Intelligence (EMAILINT): Intelligence Discipline Guide
An email address is three things at once: an identifier, a routing instruction and a piece of infrastructure history. Email...
Election Intelligence (ELECTINT): Intelligence Discipline Guide
An election is the most predictable high-risk event on any calendar: fixed date, known actors, published rules. Election intelligence is...
Breach Intelligence (BREACHINT): Intelligence Discipline Guide
Most intrusions begin with a password that already worked somewhere else. Breach intelligence is the discipline of knowing which of...
Disinformation / IO: Mission Domain Intelligence Guide
Two hundred accounts posted the same seven-word phrase within ninety seconds. None of them had existed six weeks earlier. The...
Election Security & PSYOP: Mission Domain Intelligence Guide
The claim that the count was rigged was already trending three weeks before polls opened. The infrastructure held perfectly. The...
Fraud & Identity: Mission Domain Intelligence Guide
The synthetic identity that just passed your onboarding checks has a credit file, a utility bill and eighteen months of...
Counterfeiting & IP Crime: Mission Domain Intelligence Guide
A counterfeit is not a bad copy. It is a parallel supply chain with real factories, freight forwarders, payment processors...
Cyber Crime: Mission Domain Intelligence Guide
A single business email compromise crew does not need malware. It needs a lookalike domain registered on a Tuesday, a...
