Real-time global cyber threat intelligence, rendered on an interactive 3D globe.
threatmap aggregates live indicators of compromise from eight open-source threat intelligence feeds, enriches each indicator with passive reconnaissance data, and projects the resulting picture onto a procedurally-generated Earth, giving a continuously updated view of internet-scale attack activity.
The project demonstrates production-grade engineering at the intersection of security operations, data engineering, and modern frontend development.
The pipeline runs every hour via GitHub Actions. It collects attacker infrastructure from Feodo Tracker, mass scanner IPs from DShield, bruteforce sources from Blocklist.de and CINS Army, and malware IOCs from ThreatFox. Each IP is then enriched with passive Shodan InternetDB data (open ports, exposed CVEs, and infrastructure tags) and cross-referenced against the CISA Known Exploited Vulnerabilities catalogue. MITRE ATT&CK technique identifiers are derived automatically from Emerging Threats rule signatures.
The enriched dataset is published as a static JSON payload to GitHub Pages, with no backend, no WebSocket connection, and no API keys exposed in the browser.
| Mode | Description |
|---|---|
| EVENTS | Live attack points sized by severity, coloured by malware family |
| ARCS | Directional attack flow from source infrastructure to internet transit hubs |
| HEAT | Country-level heatmap extruded by event density |
| CLUST | Campaign clustering by /24 subnet, pulsing rings surface coordinated scanning |
Free-text search runs across IP, country, ASN org, CVE, malware family, MITRE TTP, threat actor name, feed name, and Shodan tags simultaneously. All space-separated tokens must match (AND logic). Severity chips (CRIT / HIGH / MED / LOW) provide one-click filtering.
Threat actor attribution matches observed indicators against a curated database of eleven threat groups, including APT28, Lazarus Group, Evil Corp, Wizard Spider, and FIN7, using malware family, normalised tag, and TTP overlap heuristics. Actor and malware names link directly to their Malpedia entries.
MITRE ATT&CK tab lists every observed technique grouped by tactic. Clicking any technique pivots the entire view to events associated with that TTP.
IOC export produces a UTF-8 CSV or a STIX 2.1 bundle of all indicators currently visible in the filtered view, ready for ingestion into a SIEM or threat intelligence platform.
Clicking any globe point opens a full indicator detail panel showing ports, CVEs, Shodan tags, actor attribution, and one-click pivot links to VirusTotal, AbuseIPDB, and Shodan. Clicking a country polygon filters the entire view to that country, and clicking an ASN org name pivots on that infrastructure. Filter state is encoded in the URL, so any search query and active tab can be shared as a link that restores the exact view. Keyboard shortcuts are available for common actions: Esc clears filters, 1 2 3 4 switch sidebar tabs, and E A H C switch globe modes. The pipeline can also be refreshed on demand via a GitHub Actions workflow dispatch triggered directly from the status bar.
| Source | Feed type |
|---|---|
| Feodo Tracker | C2 botnet infrastructure |
| DShield | Mass scanner IPs |
| Blocklist.de | Bruteforce and attack sources |
| CINS Army | Threat intelligence blocklist |
| ThreatFox | Malware IOC sharing |
| CISA KEV | Known exploited vulnerabilities |
| Emerging Threats | IDS rule signatures → MITRE TTPs |
| Shodan InternetDB | Passive port and CVE enrichment |
GitHub Actions (hourly cron + push + manual dispatch)
│
├── pipeline/main.py
│ ├── collect : Feodo, DShield, Blocklist.de, CINS, ThreatFox
│ ├── enrich : Shodan InternetDB per-IP passive lookup
│ ├── cross-ref: CISA KEV catalogue
│ ├── tag : Emerging Threats signatures → MITRE ATT&CK TTPs
│ └── emit : public/data/{events,stats,health}.json
│
├── npm run build : React app compiled to dist/
│
└── GitHub Pages : static deployment, zero infrastructure
| Layer | Technology |
|---|---|
| Frontend | React 18, TypeScript, Vite, Tailwind CSS |
| Globe rendering | react-globe.gl, Three.js, WebGL |
| State management | Zustand |
| Vector geography | topojson-client, Natural Earth 110m |
| Data pipeline | Python 3.12, httpx, orjson |
| CI/CD and hosting | GitHub Actions, GitHub Pages |
npm install
npm run devThe development server reads from public/data/ at runtime. Sample data is included in the repository so the globe loads immediately without running the pipeline.
To regenerate live data locally:
pip install -r pipeline/requirements.txt
export MAXMIND_ACCOUNT_ID=your_id
export MAXMIND_LICENSE_KEY=your_key
python pipeline/main.pyMaxMind GeoIP2 credentials are required for geographic resolution. A free licence is available at maxmind.com. Without them, the pipeline falls back to Shodan enrichment coordinates where available.
MIT