How Stellar works

Methodology

A scheduled ingest job fetches open threat feeds, normalizes indicators, deduplicates by a stable hash of the indicator value and type, and writes a versioned JSON store. The site builds fully offline from that store. No live API calls happen in the browser or at page build time.

Each IOC is placed in the sky with a position derived from its id, so the map is stable across rebuilds. Related indicators (same malware family or shared CVE) form constellations when the group is small enough to remain readable.

Retention keeps indicators for 30 days based on last seen time, with a ceiling of 8,000 IOCs. CISA KEV CVEs are preserved when the ceiling would otherwise drop them.

Sources

• ThreatFox (abuse.ch): hashes, IPs, domains, URLs with malware family tags
• URLhaus (abuse.ch): malicious URLs and domains
• Feodo Tracker (abuse.ch): botnet C2 IP addresses
• OpenPhish: phishing URL feed
• CISA KEV: Known Exploited Vulnerabilities catalog (CVEs)
• Cysentrix Radar: editorial CVE context derived from the Radar story store

Source availability can vary. A failed feed does not cancel the others; the store keeps the last valid data for that source.

Disclaimer

Data comes from third-party open sources. Cysentrix does not guarantee completeness, accuracy, or timeliness. Indicators may be false positives, outdated, or misclassified by upstream publishers.

Stellar is intended for defensive security operations: detection engineering, blocklist hygiene, research, and situational awareness. Do not use indicators as attack targets or for unauthorized access.

IOC values are never rendered as hyperlinks on this site. Treat every indicator as potentially hostile until validated in your own environment.