Repository Index

SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.

• footprinting
• osint
• threatintel
• python

Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.

• security
• waf
• anti-bot
• blocklist

MISP (core software) - Open Source Threat Intelligence and Sharing Platform

• misp
• threat-sharing
• threat-hunting
• threatintel

Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation

• phishing
• typosquatting
• domains
• dns

Malwoverview is a first response tool for threat hunting across VirusTotal, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, ThreatFox, Triage, IPInfo, Shodan, AbuseIPDB, GreyNoise, URLScan.io, Whois/RDAP, NIST, and VulnCheck. Supports LLM enrichment, IOC extraction, YARA scanning, and Android analysis.

• malware
• virustotal
• malpedia
• urlhaus

Interesting APT Report Collection And Some Special IOCs

• apt
• cybersecurity
• malware
• security

Web app that provides basic navigation and annotation of ATT&CK matrices

• cti
• cyber-threat-intelligence
• mitre-attack
• mitre-corporation

Indicators of Compromises (IOC) of our various investigations

• ioc
• malware
• yara
• misp

Production-grade MCP server giving Claude 27 security intelligence tools across 21 APIs — CVE lookup, EPSS scoring, CISA KEV, MITRE ATT&CK, Shodan, VirusTotal, and more.

• cisa-kev
• claude-ai
• cve
• cybersecurity

Indicators of Compromise from Amnesty International's cyber investigations

• forensics
• spyware
• threat-hunting
• threat-intelligence

ThePhish: an automated phishing email analysis tool

• email
• detection
• malware
• phishing

Zero Breach — local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.

• digital-security
• forensics
• incident-response
• ioc

Malcom - Malware Communications Analyzer

• malware
• network-traffic
• pcap
• threat-intelligence

IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.

• cybersecurity
• threat
• ioc
• malware

Extract and aggregate threat intelligence.

• ioc
• indicators-of-compromise
• threatintel
• threat-intelligence

Multi-chain crypto wallet risk scanner for AML/KYT screening. Scores addresses 0–100 using sanctions, risky contracts and fund tracing. Integrates 6 intelligence providers with failover, detects scams, hacks, mixers and phishing, supports 15+ chains, batch screening and TXT/JSON/CSV/HTML/PDF reports. Python, cross-platform.

• aml
• antimoneylaundering
• blockchain-intelligence
• blockchain-security-solutions

A modular Python application to collect intelligence for malicious hosts.

• cybersecurity
• investigation

Aggregates security advisories from 10 international CERTs daily and provides an AI skill that cross-references alerts against your project's tech stack.

• cve
• security
• security-alerts
• vulnerability

Sandia Cyber Omni Tracker (SCOT)

• perl
• javascript
• cyber-security
• incident-response

Protect your SIP Servers from bad actors at https://sentrypeer.org

• sip
• voip
• security-tools
• honeypot

A modular Python application to pull intelligence about malicious files

• malware-analysis
• malware-research
• investigation
• cybersecurity

Malware/IOC ingestion and processing engine

A set of Maltego transforms for VirusTotal Public API v2.0. This set has the added functionality of caching queries on a daily basis to speed up resolutions.

Agentic memory for CTI in Python — STIX knowledge graphs, threat-actor alias resolution, offline-first RAG, MCP server for Claude Code and LangChain agents

• claude-code
• cti
• llm
• rag