How it works?

By using Nmap and Masscan, we gather all the IP addresses that are internet-connected. We deliver the working IP addresses to our services for process. All the communication between our modules are done by using logstash and kafka nodes. Our modules and their descriptions are listed below.

Service Scanner: For each port, using nmap, service finder
IP classifier: Machine learning based IP classifiacatior
Geolocation Data Provider: For each ip, geolocation provider. Geolocation includes longitude, latitude, country, city data.
Threat Data Associator: Firehol threat data collection based threat data provider. Firehol provides daily updated threat intelligence from over hundred sources.
Reverse DNS Resolver: DNS record getter by ptr result
Vulnerability Associator: Service and vulnerability associator using nmap vulnscan script. CVE (Common Vulnerabilities and Exposures) used for the reference.
Whois Data Provider: Whois data provider for reverse dns result provided by Reverse DNS Resolver
Elasticsearch: Used for storing processed data.