SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.
- footprinting
- osint
- threatintel
- python
Repository Index
76,855 visible repositories in the index
1–24 of 28 · Most stars
Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation
- phishing
- typosquatting
- domains
- dns
Malwoverview is a first response tool for threat hunting across VirusTotal, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, ThreatFox, Triage, IPInfo, Shodan, AbuseIPDB, GreyNoise, URLScan.io, Whois/RDAP, NIST, and VulnCheck. Supports LLM enrichment, IOC extraction, YARA scanning, and Android analysis.
- malware
- virustotal
- malpedia
- urlhaus
ipsets dynamically updated with firehol's update-ipsets.sh script
- blocklists
- ipset
- ipset-lists
- attacks
YARA signature and IOC database for my scanners and tools
- signature
- yara-rules
- ioc
- scanner
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
Web app that provides basic navigation and annotation of ATT&CK matrices
- cti
- cyber-threat-intelligence
- mitre-attack
- mitre-corporation
Daily feed of bad IPs (with blacklist hit scores)
- security
- blacklist
- threats
- iptables
Detect Tactics, Techniques & Combat Threats
Cyber Threat Intelligence Repository expressed in STIX 2.0
- stix
- cti
- cyber-threat-intelligence
- attack
JA4+ is a suite of network fingerprinting standards
- cybersecurity
- ja3
- ja3-fingerprint
- jarm
A database of PHP security advisories
- composer
- packagist
- php
- vulnerabilities
Protect against malicious code installed via npm, yarn, pnpm, npx, pnpx, pip, uv and poetry with Aikido Safe Chain. Free to use, no tokens required.
ThePhish: an automated phishing email analysis tool
Zero Breach — local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.
- digital-security
- forensics
- incident-response
- ioc
Online hash checker for Virustotal and other services
Aggregates security advisories from 10 international CERTs daily and provides an AI skill that cross-references alerts against your project's tech stack.
- cve
- security
- security-alerts
- vulnerability
Z-Hound — a CSV-first collector that finds public threat reports and extracts structured IoCs without a database, LLM, or API key.
Threat Intelligence Quotient Test - Dataviz and Statistical Analysis of TI feeds
A set of Maltego transforms for VirusTotal Public API v2.0. This set has the added functionality of caching queries on a daily basis to speed up resolutions.
Agentic memory for CTI in Python — STIX knowledge graphs, threat-actor alias resolution, offline-first RAG, MCP server for Claude Code and LangChain agents
- claude-code
- cti
- llm
- rag
A vulnerability patch gathering tool
Normalizer for honeypot data.
Advanced Phishing Protection: Suricata rulesets open and free
- anti-phishing
- antiphishing
- openphish
- phishing