Question 1

What is Sentinel Globe?

Accepted Answer

Sentinel Globe is a free real-time global cyberattack intelligence platform. It aggregates data from 14+ authoritative public threat-intelligence feeds — SANS DShield, abuse.ch (URLhaus, ThreatFox, Feodo Tracker, MalwareBazaar), CIRCL hashlookup, NVD, CISA KEV and more — into a 3D threat globe, IOC analyzer, blacklist checker, email header forensics tool, and crypto toolkit. Everything runs client-side with no logging and no tracking.

Question 2

Does Sentinel Globe log or store my searches?

Accepted Answer

No. Every API call goes directly from your browser to the upstream provider (SANS, abuse.ch, NVD, etc.). Sentinel Globe is static HTML/JS — no backend, no proxy, no logs. The only data received is contact-form submissions you explicitly send. HIBP password checks use k-anonymity: only the first 5 characters of a SHA-1 hash leave your machine.

Question 3

How does the IOC Analyzer work?

Accepted Answer

The Analyzer checks IPs, domains, URLs, and file hashes in parallel against 14+ threat-intelligence sources: SANS DShield, abuse.ch URLhaus + ThreatFox + MalwareBazaar, CIRCL hashlookup (NSRL), 11 DNS blacklists (Spamhaus, SORBS, Barracuda, etc.), RDAP/WHOIS, reverse DNS, SSL Certificate Transparency logs (crt.sh), full DNS records, and email-auth verification (SPF/DKIM/DMARC). Multi-engine risk scoring goes far beyond a simple blacklist check.

Question 4

How does the Blacklist Checker work?

Accepted Answer

The Blacklist Checker queries 30 public DNSBLs simultaneously via DNS-over-HTTPS (Google Public DNS). Lists include Spamhaus ZEN, SORBS, Barracuda, SpamCop, CBL Abuseat, UCEPROTECT, PSBL, Invaluement, Mailspike, Nordspam and 20 more. Most scans complete in under 3 seconds. Queries run entirely from your browser.

Question 5

What threat intelligence sources does Sentinel Globe use?

Accepted Answer

Sentinel Globe uses 14+ public authoritative sources: SANS Internet Storm Center DShield (top attacker IPs, refreshed every 30 seconds), abuse.ch URLhaus (active malware URLs), ThreatFox (IOCs), Feodo Tracker (botnet C2 IPs for Emotet, Dridex, QakBot, TrickBot, IcedID), MalwareBazaar (malware samples), CIRCL hashlookup (NSRL), NVD (CVEs last 72 hours), CISA Known Exploited Vulnerabilities, geojs.io (IP geolocation), Google Public DNS (DNSBL queries), crt.sh (Certificate Transparency), and HIBP Pwned Passwords.

Question 6

How can I analyze a suspicious IP address or domain?

Accepted Answer

Open the Analyzer tab, paste any IP address, domain name, URL, or file hash into the search box, and click Analyze. Within seconds you get: geolocation, ASN/ISP ownership, WHOIS/RDAP registration data, reverse DNS, abuse reports from SANS DShield, blacklist status across 11 DNSBLs, SSL certificate history from Certificate Transparency, DNS records, and email authentication records (SPF, DKIM, DMARC).