Rights-reviewed public intelligence

Know what you’re dealing with.

Forensia correlates live intelligence into one investigation console for indicators, malware, GitHub and the actors behind them. Start with anything suspicious and get a verdict with its evidence.

Open the console →Watch live activity

1M+

indicators

Cited

source evidence

artifact types

Free

no account

Example verdicts

Forensia

12:02:10CVE-2026-3218

Known-exploited

CVE · CISA KEV

actively exploited

12:02:07a94f2b1c9e…

Known malware

HASH · MalwareBazaar

RedLineinfostealer

12:02:04acme-login[.]com

Needs review

DOMAIN · URL analysis

lookalikeinspect first

12:02:0145.13.227.9

C2-linked

IP · C2IntelFeeds

C2infrastructure

illustrative workflowreal results cite evidence →

45.13.227.9C2-LINKED/acme-login[.]comNEEDS REVIEW/a94f2b1c9e…KNOWN MALWARE/CVE-2026-3218KNOWN-EXPLOITED/github.com/example/toolREVIEW CODE/New campaign reportSOURCE-LINKED/8.8.8.8NO ADVERSE SIGNAL/45.13.227.9C2-LINKED/acme-login[.]comNEEDS REVIEW/a94f2b1c9e…KNOWN MALWARE/CVE-2026-3218KNOWN-EXPLOITED/github.com/example/toolREVIEW CODE/New campaign reportSOURCE-LINKED/8.8.8.8NO ADVERSE SIGNAL/

unified search

Paste anything. Get the answer first.

One command bar resolves indicators and entities across the platform. The result begins with the verdict, shows which sources agree and stays explicit about anything Forensia could not verify.

✓Type detected automatically. No query language.

✓Evidence and provenance stay attached

✓No signal is never presented as “safe”

185.220.101.4malicious

C2IntelFeedsCommand-and-control infrastructure signalsignal

Network contextHosting and routing context resolvedcontext

Forensia correlationIndependent evidence kept attachedevidence

approved public evidence checkedevidence attached

global activity

fresh indicators mapped by hosting locationlive

live activity

Watch threats land in real time.

Every incoming indicator keeps its source, classification and time. The map estimates where infrastructure is hosted; it never misrepresents hosting location as attacker attribution.

Watch the live feed →

Who uses Forensia

8 investigation roles

One console. Different decisions.

Forensia is for anyone who has to decide whether a threat is real, relevant and worth acting on.

Choose the role closest to yours. The product changes the investigation path, evidence and next action without reducing the answer to a generic search result.

Security operations and incident response

Is this alert actionable right now?

Turn an unfamiliar indicator into an incident decision.

Start with an IP, domain, hash or URL. Forensia brings together sightings, infrastructure, vulnerabilities and reporting so responders can decide whether to escalate, block, monitor or close.

Investigate an alert

What you can answer

Validate an alert against current sightings, sources and infrastructure context

Connect related indicators, reports, actors and exposed services in one investigation

Make a response decision with supporting evidence and explicit coverage limits

Relevant investigation surfaces

Unified searchIP investigationHash analysisLive activity

Start with a subject

Artifact, entity, company or code

Correlate the evidence

Sources, context and relationships

Make the decision

Verdict, limits and next pivots

plans

Start open. Go deeper when the work demands it.

Anonymous lookup is the front door. A free account keeps your work together. Pro is for teams that need continuous coverage, deeper evidence and repeatable workflows.

01 · anonymous

Depth 1 of 3

Look something up now.

The fastest path from a suspicious artifact to a defensible answer. No sign-in, no card, and no account required.

Try a public lookup →

Best for

First checks

Setup

None

Cost

Free

One-off indicator lookups without sign-in
IP, domain, URL, hash and CVE coverage
Evidence, provenance and honest unknowns
Public ransomware and intelligence-report surfaces

At a glance

The investigation depth changes; the public lookup never disappears.

Capability	Anonymous	Free account	Pro
One-off lookup	Included	Included	Included
Evidence and provenance	Included	Included	Included
Save investigations	Not included	Included	Included
Continuous monitoring	Not included	Not included	Pro
Deeper investigation modules	Public basics	Public basics	Pro
Briefings and API workflows	Not included	Not included	Pro

what’s new

Recently shipped

The product changes quickly. These are real, current surfaces, not roadmap promises.

Evidence-led investigation briefs

Indicators resolve into a verdict, cited findings, pivots and explicit evidence gaps.

Open →

Ransomware claim intelligence

Search public leak-site claims and connect victim, group and reporting context.

Open →

Paste something suspicious. See what the evidence says.

Search is free, needs no account and remains the fastest way into every part of Forensia.

Open the console →

Opening Forensia workspaceacquiring

Loading the current evidence view. Navigation and account controls remain available.

Loading recent evidenceacquiring

Paste anything. Get the answer first.

One command bar resolves indicators and entities across the platform. The result begins with the verdict, shows which sources agree and stays explicit about anything Forensia could not verify.

✓Type detected automatically. No query language.

✓Evidence and provenance stay attached

✓No signal is never presented as “safe”

Capability

Anonymous

Free account

Pro

One-off lookup

Included

Evidence and provenance

Included

Save investigations

Not included

Included

Continuous monitoring

Not included

Pro

Deeper investigation modules

Public basics

Pro

Briefings and API workflows

Not included

Pro