Threat intelligence from public sources

When it applies

A defensive task needs public-source enrichment: vetting IOCs (domains, IPs, URLs, hashes, emails, wallet addresses), tracking publicly disclosed malicious campaigns, phishing activity, impersonation accounts, or scam narratives — or turning public X/Twitter chatter into leads that samples, network telemetry, or vendor sources must then verify. Confirm the collection is bounded up front (see tradecraft-scope-roe): target entities, time window, and intended use of the results. This skill does not cover brand marketing, engagement growth, automated posting, or social analytics with no security purpose.

Why it works

Public posts surface malicious infrastructure and campaigns early — often before vendor coverage — but a post only proves that a claim was published at a time, never attribution, exploitability, or maliciousness. The method therefore separates collection (bounded, source-preserving) from corroboration (independent evidence), and grades every conclusion as lead → corroborated → confirmed so downstream teams know exactly how much weight each item carries.