McCrossen Threat Intelligence Network
A proprietary, network-scale security intelligence system that correlates attack patterns across every protected site — blocking confirmed threats before they can target yours.
Network Intelligence — Live
How MTIN™ Works
Every site running McCrossen SecurityShield™ is both a defender and a sensor. When one site detects an attack, every site benefits.
Detect
SecurityShield monitors login attempts, honeypot triggers, bot signatures, and suspicious behavior on every protected site. Events are scored locally and reported to the MTIN™ aggregator.
Correlate
The aggregator scores each IP across the entire network using cross-site correlation, threat velocity, honeypot confirmation, and behavioral patterns. Multi-site attackers get amplified scores.
Protect
Verified threats are compiled into a versioned feed delivered to every subscriber. New threats are blocked network-wide within hours — before they can target individual sites.
Recent Epoch Activity
MTIN™ compiles threat intelligence into versioned feeds every 6 hours. Each compilation cycle is called an epoch.
| Epoch | Status | Started (UTC) | IPs in Feed | Delta | Feed |
|---|---|---|---|---|---|
| 2026-0130 | Collecting | Apr 18, 4:00am | — | — | — |
| 2026-0129 | Delivered | Apr 17, 10:00pm | 1,242 | +2 | 2026-v41 |
| 2026-0128 | Delivered | Apr 17, 4:00pm | 1,240 | -7 | 2026-v40 |
| 2026-0127 | Delivered | Apr 17, 1:27pm | 1,247 | -4 | 2026-v39 |
| 2026-0126 | Delivered | Apr 17, 10:00am | 1,251 | -8 | 2026-v38 |
| 2026-0125 | Delivered | Apr 17, 4:00am | 1,259 | +1,007 | 2026-v37 |
* We have identified and fixed data reporting bugs.
Customers are receiving all IP and domain blocks.
Current Feed Health
What MTIN™ Blocks
The network identifies and blocks threats that single-site security plugins miss entirely:
Credential Stuffing
Automated login attempts using stolen username/password combinations. MTIN™ detects the pattern across sites and blocks the source before it reaches yours.
Bot Reconnaissance
Automated scanners probing for vulnerabilities, exposed admin pages, and known exploit paths. Honeypot-confirmed bots receive instant network-wide blocks.
Brute Force Campaigns
Distributed login attacks that rotate IPs to evade per-site rate limits. Cross-site correlation catches the campaign even when individual sites see only a few attempts.
Known Attacker Networks
IP ranges and hosting providers frequently used for malicious activity. MTIN™ reputation scoring identifies persistent infrastructure-level threats.
Protect Your Site with Network Intelligence
Every new SecurityShield™ subscriber strengthens the network for everyone. Your site defends the network. The network defends your site.
Get SecurityShield™ →MTIN™ and SecurityShield™ are trademarks of McCrossen Marketing. USPTO trademark applications filed. All threat intelligence data shown is aggregated and anonymized — no individual IP addresses or site-specific data are exposed on this page.
