Threat intelligence
Website threat intelligence, with evidence.
Standard and Pro add indicator matches, supplementary CVE context and reported ransomware claims, saved with their source and time so you can see what was observed and what was not.
What the coverage is useful for
Indicator matching compares your monitored hostname and resolved public IP addresses with indicators published by ThreatCluster, so a match is surfaced next to your other readings.
Vulnerability context adds information on reported exploitation, exploit availability and defensive references where the provider has it. It does not prove that a technology we detected is vulnerable; the original advisory and version-matched findings remain the primary evidence.
Reported ransomware claims appear only when a leak-site record matches your exact domain. Similar company names are not enough. A claim is unverified: it is not a confirmed breach.
Stored evidence and timestamps
Each result is saved with its source and the time it was retrieved. A saved report keeps the evidence it was generated with and is not rewritten when feeds change later.
Intelligence is read-only context. These lookups do not prevent ransomware, remove listings, or contact a ransomware group.
What an empty result does not mean
Indicator matching uses a high-confidence 30-day feed, not a search of the provider's full archive. Feeds can be capped, so older records may be missing. A profile can be unavailable or absent, a provider can fail, and lookups are limited.
Missing records and failed lookups never prove a site is safe. Where coverage is unknown or incomplete, we say so rather than marking the site clean. A shared-IP match does not by itself establish that your website is compromised.
We do not promise complete historical coverage or dark-web coverage. These read-only lookups are not enrollment in ThreatCluster's separate company-monitoring service.
Attribution
Threat indicators, CVE context and ransomware claims are provided by ThreatCluster and attributed to it wherever they appear. OrionCmd reports what the provider returned; it does not vouch for it.
Plan availability
Reputation-layer threat intelligence requires a monitor covered by Standard or Pro. Free stays basic website monitoring: uptime, certificates, and domain and DNS checks for one website. It does not include paid intelligence.
Compare plans on the pricing page, see every signal on what we check, or read how OrionCmd works. Related guides: SSL certificate monitoring and domain expiration monitoring.