Passive security intelligence
ThreatLens
Understand an IP address, domain or URL before you decide what to do with it. Bring reputation, infrastructure context and your own server evidence into one investigation.
Passive only — no port scanning or exploitation
Evidence first — reputation is context, not a verdict
Privacy — log analysis below stays in your browser
Target summary
Investigation workspace
ThreatLens separates facts, reputation signals and your own observations so a single blacklist hit never becomes an automatic “dangerous” verdict.
Target profile
Basic normalization runs locally. Network intelligence should be fetched by the DEIENAMI backend so provider credentials never reach the browser.
- Target type
- —
- Host / address
- —
- Scope
- —
- Collection mode
- Passive only
Decision model
Allow, monitor, rate-limit, investigate or block only after combining multiple signals with what the target actually did on your system.
Reputation & ownership feeds
Provider adapters are deliberately server-side. This branch does not expose API keys or fabricate reputation results.
RDAP / registryDomain, IP allocation, ASN and registration context
AdapterAbuse intelligenceReported abuse history and confidence context
AdapterInternet noise contextKnown scanners, benign services and opportunistic activity
AdapterMalware reputationCross-source detections and observable relationships
AdapterLocal evidence
Server log analyzer
Paste Nginx or Apache access-log lines. ThreatLens finds source IPs, repeated requests and common probing paths without uploading the log.
Runs locally in this browser. Nothing in this box is sent to DEIENAMI.
Unique IPs0
Parsed requests0
Probe-like requests0
Top source—
| Source | Requests | Probe hits | Observed patterns | Signal |
|---|
Product scope
One target. Five views.
The next integrations can fill these views without changing the interaction model or turning ThreatLens into an active scanner.
IP Risk
ASN, provider, reverse DNS, hosting/VPN/Tor context, abuse and reputation signals.
Domain Footprint
RDAP, DNS, MX, mail security records, certificates, hosting and related infrastructure.
Infrastructure Graph
Connect domain, IP, ASN, nameserver, MX, certificate and related-domain evidence.
History
Track historical DNS, previous infrastructure and certificates when licensed sources are available.
URL Investigation
Review redirects, final host and reputation context without asking users to browse a suspicious destination.
Built for defensive investigation.
ThreatLens should explain evidence and uncertainty. It should not perform exploitation, intrusive scanning or automatically label shared infrastructure as malicious from a single source.