ThreatFusionAI™
HomeSearchDarkwebBlogs
Capabilities
  • MITRE ATT&CK MappingObserved techniques, tactic coverage and candidate threat actors for a sample.
  • Threat Hunting & IOC Cross-ReferenceStart from one indicator and pivot through everything connected to it.
  • Dark Web & External Threat ContextCredential exposure, leaked data and access brokering, tied back to the platform.
  • SOC OperationsEnrich SIEM and EDR alerts before the block-or-monitor call, by API or by hand.
Investigation tools
  • IOC Cross-ReferencePivot through connected indicators as a graph
  • ATT&CK Matrix441 techniques across 14 tactics, browsable
  • ATT&CK AttributionOverlay a sample and rank candidate actors
  • Vulnerability CatalogueCVEs by vendor and product
How it works
  • Malware AnalysisFour steps, without switching between tools
  • AI CorrelationCorrelation, prioritisation and an analyst assistant
  • What Is Threat IntelligenceFrom atomic indicators to something actionable
  • What Your Team GetsTraditional investigation against this one
Start hereOne box, seven indicator typesPaste a hash, IP, domain, URL, CVE, email or phone number and follow what it connects to. Hover anything on the left for detail.
  • 2.3M+ malware samples analysed
  • Millions of relationships mapped
  • Thousands of threat actors tracked
Open search→
Indicators
  • File HashAV verdicts, behaviour, extracted IOCs, related samples
  • IP AddressReputation, geolocation, connected malware and domains
  • DomainReputation, related hosts, malware relationships
  • URLMalicious website checker for phishing and payload links
More indicators
  • CVECVSS, EPSS, KEV status and exploit availability
  • EmailDark web exposure — masked, full records on Enterprise
  • PhoneDark web exposure — masked, full records on Enterprise
Where to start
  • Dark Web SearchCheck a phone or email against the breach corpus
  • Unified SearchOne box, all seven types, auto-detected
  • IOC Cross-ReferenceOnce you have a result, follow it outward
  • Vulnerability CatalogueBrowse by vendor when you have no CVE id
Every lookupIs also a REST callThe same enrichment runs token-authenticated inside a SOAR playbook, with no analyst in the loop. Hover an indicator type on the left for what it returns.
  • Token-authenticated REST, one call per indicator
  • The same data the browser lookup shows
  • Rate limits and quotas per plan
See the API→
Live threats
  • Threat MapMalicious IPs worldwide, updated every minute
  • CountriesThreat activity for every country
  • IOC FeedNew IPs, domains, URLs and hashes as they are reported
  • TrendingListed by the most feeds in the last 24 hours
Campaigns
  • OverviewMalware and ransomware at a glance
  • MalwareFamilies building the most new infrastructure
  • RansomwareVictims map and the groups behind them
  • Ransomware VictimsEvery leak-site post, newest first
  • Breaches & IncidentsWho was attacked, when and how
  • Is My Company Listed?Search leak sites for a company or domain
Stay informed
  • Weekly DigestThe week in malware and ransomware
  • Your AlertsSign inFollow a family, country or network
LiveThe threat mapMalicious infrastructure worldwide, refreshed every minute. Hover anything on the left for detail.
  • Command-and-control, malware, phishing and attackers
  • Countries, states and networks
  • 7-day replay
Open the map→
Developers
  • API OverviewEndpoints, authentication and rate limits
  • API ReferenceSign inEvery endpoint, with request and response shapes
  • API StatusSign inYour usage against your plan's limits
Reading
  • Threat ResearchWrite-ups and analysis from Craw Security
  • Frequently Asked QuestionsWhat the platform does and does not claim
Plans
  • PricingIndividual and team tiers
  • Who Uses ItFinance, healthcare, government, MSSPs and more
For developersAutomate the whole lookupEvery enrichment on this site is reachable as a token-authenticated REST call, so the same work can run inside a playbook with no analyst in the loop.
  • One call per indicator
  • The same data the browser shows
  • Quotas visible on your account
Start with the overview→
Company
  • About UsWho builds this, and why
  • Why UsWhat this does that a stack of portals does not
  • Contact UsTalk to an analyst about an engagement
Trust
  • Privacy PolicyWhat is collected and what is done with it
  • Terms & ConditionsAcceptable use and the terms of service
ThreatFusionAI™Built by Craw SecurityA threat intelligence platform built by people who run investigations, for people who run investigations. Hover anything on the left for detail.
  • 2.3M+ malware samples analysed
  • Millions of relationships mapped
  • Thousands of threat actors tracked
About the company→
Sign in

Shipping & Delivery Policy

Last updated: 27 October 2026

1. Nothing is shipped

ThreatFusionAI™ is an online threat intelligence service operated by Craw Cyber Security Private Limited, New Delhi, India. Plans are delivered digitally, as access on your ThreatFusionAI™ account, through the website and the API. There are no physical goods and no shipping charges.

2. When your plan is active

  • A paid plan is switched on as soon as the payment is confirmed, usually within a minute. You will see it on Billing & plan, and the new limits apply to the website and your API key at once.
  • The invoice or receipt is emailed to the billing address of your account and can be downloaded from Billing & plan.
  • The service is available worldwide, wherever the website can be reached.

3. If your plan is not active

If a payment has gone through but your plan is not active within one hour (a bank can delay a confirmation), write to support@threatfusionai.com or call +91 951-380-5401 with the payment details. We will switch the plan on, or refund the payment in full, as described in our Cancellation & Refund Policy.

4. Contact

Craw Cyber Security Private Limited, Plot 4, Lane 2, Kehar Singh Estate, Westend Marg, Saidulajab, New Delhi 110030, India · support@threatfusionai.com · Contact page.

ThreatFusionAI™
By Craw Security

AI-Powered unified Threat Intelligence & Cyber Defense Platform. Collect, correlate, analyze, and act on threats in real time.

Platform
  • MITRE ATT&CK Mapping
  • Threat Hunting & IOC Cross-Reference
  • Dark Web & External Threat Context
  • SOC Operations
  • Plans
  • API Overview
About us
  • About
  • Why Us
  • Craw Security
  • Privacy Policy
  • Terms & Conditions
  • Cancellation & Refunds
  • Shipping & Delivery
Connect
support@threatfusionai.com
+91 951-380-5401
Plot no. 4, Lane no. 2,Kehar Singh Estate, Westend Marg, Behind Saket Metro Station, Saidulajab, New Delhi - 110030
Threat Intel Newsletter
Stay ahead of emerging threats

Get new research, advisories, and platform updates delivered to your inbox. No spam — unsubscribe anytime.

© 2026 ThreatFusionAI™ by Craw Cyber Security Pvt Ltd. All Rights Reserved.
Demo
ThreatFusionAI™ Product Walkthrough
The fastest way to see what ThreatFusionAI does is to run a search. Paste any hash, IP, domain or CVE and you'll get the full report, the connected indicators and the actor attribution in one pass.
What you'll see
  • • Verdicts from multiple antivirus engines
  • • The connected IOC graph you can click through
  • • Ranked threat actors based on ATT&CK overlap
Next step
Start with a free search, no card needed. Check the plans if you need more volume.

Security check

Confirm you're human to continue.