Repository Index

SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.

• footprinting
• osint
• threatintel
• python

Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.

• security
• waf
• anti-bot
• blocklist

Open Cyber Threat Intelligence Platform

• cyber
• cti
• threat-intelligence
• security

MISP (core software) - Open Source Threat Intelligence and Sharing Platform

• misp
• threat-sharing
• threat-hunting
• threatintel

Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation

• phishing
• typosquatting
• domains
• dns

IntelOwl: manage your Threat Intelligence at scale

• security-tools
• python
• threat-intelligence
• ioc

Malwoverview is a first response tool for threat hunting across VirusTotal, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, ThreatFox, Triage, IPInfo, Shodan, AbuseIPDB, GreyNoise, URLScan.io, Whois/RDAP, NIST, and VulnCheck. Supports LLM enrichment, IOC extraction, YARA scanning, and Android analysis.

• malware
• virustotal
• malpedia
• urlhaus

Interesting APT Report Collection And Some Special IOCs

• apt
• cybersecurity
• malware
• security

YARA signature and IOC database for my scanners and tools

• signature
• yara-rules
• ioc
• scanner

Vulnerability Intelligence Platform

• cve
• vulnerabilities
• security-tools
• nvd

Web app that provides basic navigation and annotation of ATT&CK matrices

• cti
• cyber-threat-intelligence
• mitre-attack
• mitre-corporation

JA4+ is a suite of network fingerprinting standards

• cybersecurity
• ja3
• ja3-fingerprint
• jarm

Real-time phishing & scam domain blocklist - 205k+ curated threats, 1M+ community, free API, multiple formats

• blacklist
• cybersecurity
• domains
• drainer

Indicators of Compromises (IOC) of our various investigations

• ioc
• malware
• yara
• misp

Living Off The Land Drivers

• drivers
• malicious

Production-grade MCP server giving Claude 27 security intelligence tools across 21 APIs — CVE lookup, EPSS scoring, CISA KEV, MITRE ATT&CK, Shodan, VirusTotal, and more.

• cisa-kev
• claude-ai
• cve
• cybersecurity

Indicators of Compromise from Amnesty International's cyber investigations

• forensics
• spyware
• threat-hunting
• threat-intelligence

Phishing Domains, urls websites and threats database. We use the PyFunceble testing tool to validate the status of all known Phishing domains and provide stats to reveal how many unique domains used for Phishing are still active.

• phishing
• phishing-sites
• phishing-reports
• phishing-servers

ThePhish: an automated phishing email analysis tool

• email
• detection
• malware
• phishing

Zero Breach — local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.

• digital-security
• forensics
• incident-response
• ioc

IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.

• cybersecurity
• threat
• ioc
• malware

Extract and aggregate threat intelligence.

• ioc
• indicators-of-compromise
• threatintel
• threat-intelligence

Multi-chain crypto wallet risk scanner for AML/KYT screening. Scores addresses 0–100 using sanctions, risky contracts and fund tracing. Integrates 6 intelligence providers with failover, detects scams, hacks, mixers and phishing, supports 15+ chains, batch screening and TXT/JSON/CSV/HTML/PDF reports. Python, cross-platform.

• aml
• antimoneylaundering
• blockchain-intelligence
• blockchain-security-solutions

Tool to gather Threat Intelligence indicators from publicly available sources