I Built a Threat Intelligence Tool That Maps Malicious IPs in Real Time

What I Built The Breadcrumb Engine is a Python tool that takes a list of IP addresses and plots them on an interactive dark-mode map, enriched with real-time threat intelligence from VirusTotal. Each IP is colour-coded by risk level and the full dataset is exportable as CSV. 🟢 Green → 0–4% (Clean) 🟠 Orange → 5–14% (Suspicious) 🔴 Red → 15%+ (Malicious) The Stack Streamlit — web UI with zero frontend code Folium — interactive map rendering on a CartoDB dark basemap VirusTotal API — aggregates 90+ security vendor votes per IP ipinfo.io — HTTPS geolocation pandas — data handling and CSV export What I Learned 1. Never hardcode API keys This seems obvious but it's easy to slip up when prototyping. The fix is simple — use environment variables: VT_API_KEY = os . environ . get ( " VT_API_KEY " ) And on Mac, make it permanent: echo 'export VT_API_KEY="your_key_here"' >> ~/.zshrc source ~/.zshrc 2. HTTP geolocation is a MITM risk The original version used http://ip-api.com — plain HTTP. On a clo