From a report to a blocklist.

Every indicator on CybrCrime.com goes through five stages: collect, clean, connect, review and share. Open feeds and member reports go in; verified, linked and labelled intelligence comes out through one API. People learn to do this work in the CybrCrime Arcade.

How does a report become a blocklist?

  1. 1

    Collect

    Open feeds such as URLhaus, ThreatFox, CISA KEV and Spamhaus DROP arrive on a schedule. Members add their own findings through forms, the API or CSV imports.

  2. 2

    Clean

    Every value is validated, deduplicated and tagged with its family, confidence, source and licence. Crypto addresses are checksum-checked.

  3. 3

    Connect

    Routing rules link related records across trackers, so a stealer server, the market selling its logs and the wallet receiving payment appear together.

  4. 4

    Review

    Moderators and verified peer reviewers check community submissions. Anything that names a person needs evidence and goes through a dispute process.

  5. 5

    Share

    Members pull feeds in CSV, JSON, STIX 2.1 and blocklist formats through one API. Only TLP:CLEAR aggregate statistics are public.

Which formats can members use?

  • CSV, JSON, NDJSON, TXT and RSS feeds
  • STIX 2.1 and MISP
  • Hosts, RPZ and IP blocklists
  • Sigma, YARA, KQL and SPL rule packs

House rules

  • Use the data for defence only
  • Respect TLP and keep member data private
  • Share evidence, not accusations
  • Protect victims and their privacy
  • Stay within the law where you work
  • Keep your OPSEC tight: never interact with, test or tip off the infrastructure you report, and keep investigations off personal accounts and devices

How does the CybrCrime Arcade train defenders?

The Arcade works like a language-learning app for cybercrime. Each level is a 24 to 48 hour track split into 10 to 15 minute units. Lessons are followed by real cases from attacks on companies and government bodies, where you make the call at key moments and then see what really happened, with sources.

Daily habit

Daily XP goals, streaks, streak freezes and hearts keep practice short and regular.

Real cases

Fifty publicly documented attacks in Level 0 alone, each with a timeline, decisions and sources.

Unlock by contributing

Clear a level, then get real intelligence accepted into the matching tracker to open the next one.

Earn roles

Roles are earned by playing or verified by the Site Review team, and they decide what you can see and do.

Learning path: Level 0 Cyber Security Essentials, then Player Onboarding (investigator OPSEC and toolkit), then the Fraud world (ScamHost, MuleNode, Crypto Tracker, ScammerID), the Delivery world (PhishKit Bazaar, MalAdvert, StealerGate Tracker), the Underground world (BotMarket Tracker, CredRouter, BulletProof Radar, RansomFeed, ExploitBazaar), and DetectHub as the final level.

Start Level 0 freeBrowse the Intel Library

Last updated by CybrCrime.com