PHANTOM — Threat Intelligence Workbench

Total IOCs

Domains

IP Addresses

File Hashes

IOC Distribution

◈

No IOCs in database yet.
Run an IOC extraction first.

Recent Activity

⊹

No recent activity.

Quick Start

⬡

IOC Extractor

Paste threat report or raw text to auto-extract IOCs

⬢

File Analyzer

Upload any file for hash, entropy, YARA-lite analysis

⊹

ATT&CK Mapper

Map TTPs to MITRE ATT&CK, export Navigator layer

Input

Paste threat report, raw text, CTI report, email, logs...

Defanging auto-detected

Extracted IOCs

–

⬡

Extracted IOCs will appear here.

⬢

Click or drag file to analyze

PE/ELF/APK/PDF/ZIP/Scripts — max 50MB — all analysis runs locally in browser

Technique Search

Selected TTPs

0 selected

ATT&CK Coverage Heatmap

Selected Techniques

Diamond Model Builder

Instance Name / Campaign

Adversary

Capability

Infrastructure

Victim

Meta-Feature: Phase (Kill Chain)

Confidence

TLP

TLP:RED TLP:AMBER TLP:GREEN TLP:CLEAR

Notes / Context

Diamond Visualization

Adversary

Not set

Capability

Not set

Infrastructure

Not set

Victim

Not set

Saved Instances

◇

No saved instances yet.

IOC Database

Value	Type	TLP	Confidence	Source	Tags	First Seen	Count
No IOCs in database

Report Parameters

Report Title

Analyst Name

Organization

TLP Classification

Report Date

Executive Summary

Threat Actor / Attribution

Campaign Description

Technical Analysis

Recommendations

Report Preview

// Click Preview to generate report preview

Tools

Input

Output [copy]

Input Hashes

Paste one or more hashes (one per line)

Reference — Common Hash Lengths

MD5 / NTLM

32 hex

SHA-1

40 hex

Tiger/192

48 hex

SHA-256

64 hex

SHA-384

96 hex

SHA-512

128 hex

Identification Results

⊠

Results appear here

Suspicious URL

URL (defanged OK: hxxp://, [.], [at])

Analysis Engine

✓ DGA Detection

Shannon entropy analysis on domain

✓ Brand Impersonation

50+ brand keywords + homoglyphs

✓ Typosquatting

Digit/letter substitution check

✓ Suspicious TLD

List of abused TLD registry

✓ Open Redirect

Query param redirect detection

✓ Punycode/IDN

Unicode homograph detection

✓ Deep Subdomain

Subdomain chain depth analysis

✓ Credential URL

Username:password in URL check

⊡ Zero external API — all analysis runs locally in your browser. No URLs are sent to any server.

Analysis Results

⊡

Paste a URL and click Analyze

Profile Builder

Actor Name / Group

Aliases (comma separated)

Country of Origin

Primary Motivation

Threat Level

Confidence %

First Seen

Last Active

Target Sectors (comma separated)

Known Tools & Malware (comma separated)

ATT&CK TTPs (comma separated)

Description

TLP

TLP:RED TLP:AMBER TLP:GREEN TLP:CLEAR

Profile Card Preview

◆

Fill in the form to generate a profile card