Overview

This tool compares threat intelligence from multiple providers side by side, with Censys as the primary benchmark. Enter any indicator — IP, IP:port, domain, domain:port, URL, or hash — and see what each provider knows about it, where they agree, and where they diverge.

Getting started

Quick start: Type an IP address in the search bar and click Run Comparison. In Mock mode (the default), you'll see simulated data from all providers — no API keys needed. Switch to Live mode when you're ready to query real APIs.

Sample indicators: Below the search bar you'll find curated sets of IPs organized by profile — contested (providers disagree), known-bad (from threat feeds), and known-good. Click any chip to run a comparison instantly.

Indicator types

Understanding the results

Consensus strip — A card for each provider showing its verdict (malicious / suspicious / benign / unknown), data freshness, and whether the result came from cache.

Censys vs. Other Tools panel — The main comparison view. Shows Censys's risk score as a gauge, the field consensus beside it, a divergence bar, and a narrative headline explaining the comparison. The narrative always leads with what Censys found.

Censys Actions panel (live mode only) — Appears when gaps are detected between Censys and other scanners:

• Freshness gap — Another scanner scanned more recently. Click "Rescan on Censys" to trigger a live rescan (~10 seconds).
• Port gaps — Other scanners see ports Censys doesn't. Click "Discover [port]" to trigger a live discovery scan for that specific port, or "Discover all" to scan all missing ports.

Attribute matrix — Every field from every provider, side by side. Rows include: reputation, category, threat labels, software, OS, services, ports, CVEs, KEV (CISA Known Exploited Vulnerabilities), DNS names, and more. A "—" means the provider doesn't have that data.

Provider cards — Detailed view per provider: all attributes, native score, data freshness, cache status, and a link to the provider's own UI.

Verdicts explained

Each provider assigns a verdict based on its own classification. This tool never invents a verdict — it only reports what the provider says:

Live threat feeds

The Compare tab includes live feed buttons that pull recent C2/malware IPs from public threat intelligence feeds:

• Feodo C2 — Dridex, Emotet, TrickBot, QakBot command-and-control servers (abuse.ch)
• ThreatFox — Cobalt Strike, AsyncRAT, Remcos, RedLine, and more (abuse.ch, last 24h)
• SSL Blacklist — IPs using malicious SSL certificates (abuse.ch)

Click any loaded IP chip to run a comparison. Use the ✕ button to close individual feeds or "close all" to clear everything.

Censys Collection feeds

Admins can configure Censys Collection UUIDs in Settings. These pull recently-added IPs from your Censys Collections and display them as clickable feeds in the Compare tab. Each user can toggle which collection feeds they see.

To add a collection (admin): Go to Settings → Censys Collection Feeds → + Add Collection. Enter the display name, the Collection UUID from Censys Platform, max IPs to fetch (1-100), and cache TTL.

Caching and freshness

Provider results are cached for 5 minutes to prevent API quota burn. Each source card shows whether data came from cache (amber "cached" label) and when it was fetched.

Check the Force fresh box next to Run Comparison to bypass the cache and pull live data from every provider. Use this for critical investigations where you need real-time verdicts.

Settings

Providers — Toggle which providers run for your comparisons. The status badge shows: CONNECTED ✓ (key present), KEY MISSING ⚠ (needs secret), or NO KEY NEEDED. Admins can change weights and labels; users can only toggle on/off.

Test button (admin) — Fires a test lookup against a safe IP (8.8.8.8) to verify the API key works. Shows the result inline.

Custom providers (admin) — Add any REST API as a comparison source. Provide the URL template with {indicator}, auth header, and JSON paths for risk/verdict fields.

Saving — Admin saves update global defaults (weights, labels, providers). Non-admin saves update per-user toggle preferences only.

Mock vs. Live mode

Mock — Synthetic data, deterministic by indicator. Uses seed profiles (benign, malicious, suspicious, contested) so providers simulate disagreement. No API keys needed. Great for demos and testing.

Live — Real API calls to each enabled provider. Requires configured API keys. Results are cached for 5 minutes. Use "Force fresh" for real-time data.

History

Every comparison is saved automatically. The History tab shows two views:

• Recent — Your latest lookups, newest first. Click any row to reload the full comparison.
• Most contested — Indicators ranked by divergence score — where providers disagree the most.

Users see their own history; admins see all users' history.

Keyboard shortcuts

Press Enter in the search bar to run a comparison. No other keyboard shortcuts currently — the tool is designed for click-driven workflows.

Troubleshooting

Admin guide

Admin users (those listed in ADMIN_EMAILS or promoted by another admin) have additional capabilities:

Note: User management, domain allowlist, and audit log are currently API-only (no UI panels yet). Use the browser console or curl to access them.

Provider reference