What is coming next
The CVE-2026-41940 threat feed is live today. The wider Signal ecosystem ships in stages. Below are the surfaces in flight, with rendered preview teasers from the working prototype.
IP reputation lookup
Q3 2026Public IP / CIDR / domain lookup against the Signal corpus. Threat scoring, classification tags, MITRE ATT&CK mapping, related infrastructure, feed cross-references, and a zero-friction free tier.
Risk factors
MITRE ATT&CK
Classifications
Fleet dashboard & intel
Q4 2026Per-fleet activity, ranked attacker view, and the live event stream rolled into a single view. AI-assisted triage queue attached to each block.
24h activity · stacked by category
Top attackers · 24h rolling
412K events| # | IP | Country | Events | Kind |
|---|---|---|---|---|
| 1 | 80.75.212.14 | 🇩🇪DE | 412 | Pattern X badpass |
| 2 | 94.231.206.39 | 🇷🇺RU | 287 | Pattern X badpass |
| 3 | 142.93.43.26 | 🇺🇸US | 256 | Pattern X badpass |
| 4 | 45.82.78.104 | 🇧🇬BG | 198 | Websocket Shell |
| 5 | 206.189.2.13 | 🇺🇸US | 145 | Scanner (leakix) |
| 6 | 157.245.204.205 | 🇺🇸US | 132 | Scanner (leakix) |
Custom threat feeds
Q3 2026Build per-organisation block lists from 18 threat categories. Confidence tiers, geo / ASN filters, refresh cadence, .txt / .json / .csv / STIX output, drop-in for APF, iptables, ipset, pfSense, fail2ban.
Build a custom block list · 18 categories
3 selected · 218,621 IPsCLI & API
Q3 2026Single binary for terminal-native lookup, feed sync, and APF / iptables rule generation. REST + JSONL streaming endpoints. MCP server for Claude Code, Cursor, and other AI agents.
$ signal lookup 80.75.212.14 ip: 80.75.212.14 score: 94 / 100 MALICIOUS country: DE asn: AS44066 (First Colo GmbH) classes: brute force, Pattern X, listed-in-12-feeds mitre: T1190 T1110 T1595 T1499 firstSeen: 2025-08-12T03:14:00Z lastSeen: 2 minutes ago $ signal feed sync apf --tag cve-2026-41940 fetched: 34 indicators · 0 stale · 0 errors applied: /etc/apf/deny_hosts.rules reload: apf -r (ok)
Roadmap at a glance
Eight surfaces, three release waves. Tell us which one you need first.
Want any of this sooner?
Drop us a note. We are onboarding small cohorts as each surface ships, and the priority queue is set by who is actively waiting on what.