SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.
- footprinting
- osint
- threatintel
- python
47,133 repositories indexed
1–20 of 20 · Most stars
SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.
Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.
MISP (core software) - Open Source Threat Intelligence and Sharing Platform
Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation
ThePhish: an automated phishing email analysis tool
Zero Breach — local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.
IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.
Extract and aggregate threat intelligence.
OASIS TC Open Repository: Python APIs for STIX 2
Collecting & Hunting for IOCs with gusto and style
Protect your SIP Servers from bad actors at https://sentrypeer.org
Open Source Threat Intelligence Platform
A set of Maltego transforms for VirusTotal Public API v2.0. This set has the added functionality of caching queries on a daily basis to speed up resolutions.
Agentic memory for CTI in Python — STIX knowledge graphs, threat-actor alias resolution, offline-first RAG, MCP server for Claude Code and LangChain agents
The Intelligent Honey Net Project attempts to create actionable information from honeypots
🛡️ Free AI that blocks hackers while you sleep. Runs on cheap hardware. When someone in Tokyo gets attacked, you're protected in 30 seconds. No fees. No experts needed. Just protection. One node's detection → everyone's protection.
Advanced Phishing Protection: Suricata rulesets open and free
Self-hosted AI-assisted CTI-to-detection workbench for ATT&CK mapping, IOC/CVE intelligence, Threat Radar, malware triage, Attack Simulation, and SIEM validation.
Prompt-injection firewall for LLM applications — 33 input detectors, 9 output scanners, federated ed25519-signed threat-intel feed. Apache 2.0, 1040 tests, F1 96.0% with 0% false positives. Docker, GitHub Action, LangChain/LlamaIndex/CrewAI integrations.
Is this app legit? Check before you connect. Free URL security scanner for indie developers and AI builders. Live at trustscanpro.com