Wallhacks by Windsor Security
Wallhacks clusters indicators from public intelligence feeds and publishes what it finds — with the corpus, the sources, and the methodology in the open. No unverifiable claims. No anonymous case studies.
Every feed is public and auditable. Nothing proprietary or undisclosed contributes to these figures.
Four steps, and the last one is the one most tools skip.
Public feeds are pulled on a daily schedule and filtered by indicator type, recency window, and TLD risk before anything enters the corpus.
Each indicator is enriched against multiple providers, then normalised into a single scoring schema so signals from different sources stay comparable.
Indicators and public threat reporting are embedded into a vector space and grouped without supervision, surfacing structure no analyst defined in advance.
Nothing publishes automatically. Every finding is checked by a human against primary sources first.
Published one at a time, as each is checked against primary sources.
On 7 January 2026 the clustering run grouped four CISA-sourced advisory documents into a single coherent cluster centred on this vulnerability, with no analyst defining the campaign, the vendor, or the CVE in advance. The grouping formed roughly three weeks after the vulnerability entered CISA's Known Exploited Vulnerabilities catalogue.
Read the full finding and methodology →The same engine behind the findings above is open for you to query.
Submit a domain, IP, hash, or URL and get normalised context from multiple intelligence sources in one response.
See which other indicators share infrastructure or behaviour, so a single alert resolves into the wider picture.
A 0–10 score with an explicit confidence level, built to support a triage decision rather than replace it.
Paste in an indicator and see what comes back.