Project Tarragon CTI: Curated OSINT CTI data (Beta 26:Q2)
 
 
Active CTI IoCs:
 
Aggressive IPs:
20101 available (as of around 05:30 z today)
 
Tor exit node data: 
2010 Total Tor nodes active
1275 Total IP4 only Tor nodes active
 
C2/c2c IPs active now are:
1786 (ephemeral and persistent) of which:
90 are ephemeral; and
1696 are persistent
The trend is slightly up at 5% - (Based on the last seven days of data).

ClickFix (CAPTCHA attack leading to credential theft/data exfiltration):
2651 are currently active



Tarragon OTX Baseline CTI IoCs (for SIEM/SoC Threat Hunting):
(NB TLP:RED data is not listed here)

Current Tarragon Community IoC data (updated frequently every day day):
18 CVEs IoCs available
8726 Domains IoCs available
494 Email-Address IoCs available
4363 Hash-MD5 IoCs available
1856 Hash-SHA1 IoCs available
5448 Hash-SHA256 IoCs available
8525 Hostname IoCs available
233 IPv4-CIDR IoCs available
24706 IPv4 IoCs available
57 IPv6 IoCs available
10315 URL IoCs available
3 Uncategorised IoCs available
These data sets are built from the Tarragon OTX IoC Pulses listed below:

Direct-Nightwatch AcoliadSQL scansattacks [190626]
Direct-Nightwatch Honeypot-002 Apache Web Server Attacks from non UK hosts [130626]
Direct-Nightwatch Honeypot-002 Apache Web Server Attacks from non UK hosts [200626]
Direct-[MISP] RAT Report from the last 24hrs [130626]
Direct-[MISP] RAT Report from the last 24hrs [140626]
Direct-[MISP] RAT Report from the last 24hrs [150626]
Direct-[MISP] RAT Report from the last 24hrs [160626]
Direct-[MISP] RAT Report from the last 24hrs [170626]
Direct-[MISP] RAT Report from the last 24hrs [180626]
Direct-[MISP] RAT Report from the last 24hrs [190626]
Direct-[MISP] RAT Report from the last 24hrs [200626]
Direct-[MISP] RAT Report from the last 24hrs [210626]
Direct-[MISP] RAT Report from the last 24hrs [220626]
Direct-[MISP] RAT Report from the last 24hrs [240626]
Direct-[MISP] RAT Report from the last 24hrs [250626]

Community-Docusign Phishing [190626]
Community-Phishing [W2-June-26]
Community-Phishing [W3-June-26]
Community-Phishing
Community-QYQsabq2Hap3kZW
 
These are enriched data sets that include the above data (updated twice a day).
0  IoCs available

At this time: 0 IoCs available

 
 
Special Catagory CTI IoCs:
 
zED (DNS based) Data:
19610 Tested, known risky email domains (from 36797 tested this week)
698 CTAG RAG rated supplier domains
 
RSS Feeds:
2 Currently Operational (Knapweed Ransomware claims & NN DDOS Warning)
 
 
 
Tarragon CTI: Curated open-source, community-driven, actionable cyber threat intelligence supporting the UK Public Sector
              By The Tarragoons, JTW & CryptoMoose
              Free of cost for UK Public sector use made possible by: South East Employers/SEGWARP

              https://tarragon-cti.uk


Version:      Oldaport/V25.1205
Timestamp:    2026-06-25-at-12:00:01 z