European Threat Intelligence Platform
DreadNet continuously scans the open internet to surface exposed threat actor panels, insecure C2 infrastructure, and misconfigured attack assets — before they reach your network.
Core Capabilities
A purpose-built platform for European security teams who need actionable intelligence, not raw data dumps.
Automated detection of exposed malware C2 dashboards, RAT admin panels, botnet management interfaces, and phishing kits accessible from the public internet.
Active ScanningContinuously surface exposed databases, open admin interfaces, default credentials, unprotected APIs, and misconfigured cloud assets across European IP ranges.
Config AnalysisAll data processed and stored exclusively within EU boundaries. Full compliance with NIS2 and DORA directives. Privacy-by-design with zero data residency outside Europe.
EU CompliantStructured IOC feeds in STIX 2.1, JSON, and CSV. Webhook integrations with SIEM platforms, Splunk, Elastic, Microsoft Sentinel, and custom endpoints.
STIX 2.1Map relationships between IPs, ASNs, domains, certificates, and hosting providers. Pivot from a single IOC to reveal the full infrastructure of a threat actor.
Graph AnalysisFull REST & GraphQL API access. SDKs for Python and Go. Bulk query, historical data access, and automated vulnerability attribution pipelines.
REST / GraphQLLive Query Demo
Query millions of indexed hosts using DreadNet's purpose-built threat intelligence syntax. Filter by panel type, malware family, ASN, country, or port.
panel:cobalt-strike
panel:asyncrat OR njrat
country:EU service:redis auth:none
asn:AS13335 port:50050
Process
Our distributed EU-based scanner fleet probes IPv4/IPv6 space across all ports, capturing banners, certificates, and service fingerprints.
ML-driven classifiers identify known threat actor panel signatures, malware C2 patterns, and insecure admin interfaces with low false-positive rates.
Each finding is enriched with ASN data, geolocation, WHOIS, certificate chains, related infrastructure, and historical context.
Results pushed instantly to your SIEM, TIP, or custom webhooks as STIX 2.1 bundles — or queried interactively via the platform and API.
Live Intelligence
Pricing
We're finalizing our pricing plans. Join early access to lock in founding member rates.
Starter
For individual researchers and small security teams getting started with threat intelligence.
Team
For SOC teams and MSSPs needing automation, integrations, and deeper historical context.
Enterprise
For large enterprises, national CERTs, and organisations requiring on-premise or dedicated infrastructure.
Abuse & Responsible Disclosure
DreadNet is built for defensive security. Our platform is designed to help security teams protect their infrastructure, not to enable malicious activity.
If you believe DreadNet data is being used in violation of our terms of service, or if you have identified an asset that was incorrectly indexed, please contact our abuse team immediately.
We take every report seriously and commit to responding within 24 hours on business days.
abuse@dreadnet.euDreadNet operates exclusively within EU jurisdiction. All scanning, processing, storage, and alerting infrastructure is hosted in certified EU data centres. We are aligned with NIS2, DORA, and GDPR — providing your legal and compliance teams with the documentation they need.
Join the early access programme and get the first 30 days free.
No credit card required.
🔒 EU data only · No spam · Cancel anytime