Perimeter intelligence
Adversary infrastructure seen across the region's edge, shared the moment it appears.
Pre-launch · Central European Intelligence CommunityA community for sharing
A community for sharing
perimeter intelligence.
What's probing the edge of Central Europe's critical infrastructure, shared the moment we see it. Hosted in Switzerland, governed by Swiss law. We're assembling the founding members now.
Founding cohort forming · opening 2026 · 24-organisation capacity
What's coming
Four streams, one perimeter.
At launch, members get one shared view of the region's edge. Here's what flows through it.
DNS sinkhole
Anonymised hits from the SENTINEL sinkhole — which networks resolved known-adversary infrastructure, the earliest signal of staging.
Deep dives
Campaign teardowns and attribution — the reasoning behind an indicator.
Preemptive indicators
A tiered query over adversary infrastructure mapped during staging. Query-only; no feed.
SENTINEL · preview
A look at the intelligence.
Illustrative of what members will query at launch. Public sees burned and disclosed infrastructure in full; live, undisclosed indicators stay redacted.
SNT-C2-2026-04-9F2A
Confirmed
Disclosed · still live
Cobalt Strike team-server infrastructure provisioned ahead of a financial-sector intrusion set — caught 11 days before public confirmation.
cdn-telemetry-eu[.]net
domainSNT-IAB-2026-04-7C10
Probable
Live · undisclosed
Initial-access broker staging infrastructure, reused across three previously burned clusters.
Withheld — still live, undisclosed
Sample records. Live querying opens to members at launch.
How it works
We build the tooling. We share it.
We built the sensors, the sinkhole, and the indicator platform to watch the perimeter. We share them rather than lock them away. Join, get the tools and the intelligence; your hits flow back anonymised. The more networks that share, the more every member sees.
Membership
Three ways to join.
From individuals to enterprises, sharing deepens access. Founding members shape the charter.
Individual
Personal use — account-based protective DNS and the open indicator view. No public resolver.
Researcher
Academics, analysts and journalists — credentialed query access and telemetry.
Enterprise
Organisations — perimeter intelligence with member-network cross-correlation.
Be among the founding members.
Tell us who you are. We'll reach out as the founding cohort opens. One note when we launch, nothing else.
Swiss-hosted · sovereign
Central European reach. Swiss jurisdiction.
The community will span Central Europe; the platform never leaves Switzerland. Operated by CICS GmbH, Baar / Zug.