alienvault Web
https://otx.alienvault.com/
AlienVault OTX community intel
How to use it
Search IPs, domains, hashes for community 'pulses' of related indicators; free account unlocks API.
Open resource →
pulsedive Web
https://pulsedive.com/
Threat-intel aggregation
How to use it
Look up IOCs and pivot across linked indicators; free tier with API.
threatminer Web
https://www.threatminer.org/
Threat-intel data mining
How to use it
Search domains, IPs, hashes, SSL certs and pivot through related indicators.
abuseipdb Web
https://www.abuseipdb.com/
IP abuse reports
How to use it
Check if an IP is reported for brute-force/spam, and report abusive IPs you observe.
talosintelligence Web
https://talosintelligence.com/
Cisco Talos reputation center
How to use it
Look up IP/domain reputation and read Talos threat research.
abuse Web
https://abuse.ch/
Abuse.ch platforms hub
How to use it
Gateway to ThreatFox (IOCs), URLhaus (malware URLs), MalwareBazaar (samples) and more — all free, no signup.
abuse Web
https://threatfox.abuse.ch/
Abuse.ch platforms hub
How to use it
Gateway to ThreatFox (IOCs), URLhaus (malware URLs), MalwareBazaar (samples) and more — all free, no signup.
abuse Web
https://urlhaus.abuse.ch/
Abuse.ch platforms hub
How to use it
Gateway to ThreatFox (IOCs), URLhaus (malware URLs), MalwareBazaar (samples) and more — all free, no signup.
abuse Web
https://bazaar.abuse.ch/
Abuse.ch platforms hub
How to use it
Gateway to ThreatFox (IOCs), URLhaus (malware URLs), MalwareBazaar (samples) and more — all free, no signup.
abuse Web
https://feodotracker.abuse.ch/
Abuse.ch platforms hub
How to use it
Gateway to ThreatFox (IOCs), URLhaus (malware URLs), MalwareBazaar (samples) and more — all free, no signup.
abuse Web
https://sslbl.abuse.ch/
Abuse.ch platforms hub
How to use it
Gateway to ThreatFox (IOCs), URLhaus (malware URLs), MalwareBazaar (samples) and more — all free, no signup.
misp-project Web
https://www.misp-project.org/
MISP threat-sharing platform
How to use it
Self-host a MISP instance to store, correlate and share IOCs with communities via feeds.
MISP GitHub
https://github.com/MISP/MISP/
Open-source code repository
How to use it
Open the repo page, read the README for install instructions (usually a git clone or pip install command), then run it in a terminal. Check the 'Issues' and 'Releases' tabs for updates.
opencti GitHub
https://github.com/opencti-platform/opencti/
Open-source code repository
How to use it
Open the repo page, read the README for install instructions (usually a git clone or pip install command), then run it in a terminal. Check the 'Issues' and 'Releases' tabs for updates.
IntelOwl GitHub
https://github.com/intelowlproject/IntelOwl/
Open-source code repository
How to use it
Open the repo page, read the README for install instructions (usually a git clone or pip install command), then run it in a terminal. Check the 'Issues' and 'Releases' tabs for updates.
github Web
https://intelowlproject.github.io/
IntelOwl docs
How to use it
Deploy the IntelOwl Docker stack to run dozens of analyzers (VT, AbuseIPDB...) on files and observables from one API.
assemblyline GitHub
https://github.com/CybercentreCanada/assemblyline/
Open-source code repository
How to use it
Open the repo page, read the README for install instructions (usually a git clone or pip install command), then run it in a terminal. Check the 'Issues' and 'Releases' tabs for updates.
virustotal Web
https://www.virustotal.com/gui/home/search/
Multi-engine malware scanner
How to use it
Upload a file or paste a URL/hash to get verdicts from 70+ antivirus engines plus behavior reports. Don't upload confidential files — uploads are shared.
virustotal Web
https://www.virustotal.com/gui/home/upload/
Multi-engine malware scanner
How to use it
Upload a file or paste a URL/hash to get verdicts from 70+ antivirus engines plus behavior reports. Don't upload confidential files — uploads are shared.
hybrid-analysis Web
https://www.hybrid-analysis.com/
Free malware sandbox
How to use it
Upload a suspicious file or URL to get a full behavior report: network traffic, dropped files, screenshots.
tria Web
https://tria.ge/
Interactive malware sandbox
How to use it
Submit samples and interact with the live VM during analysis; detailed behavior reports with a free account.
joesandbox Web
https://www.joesandbox.com/
Deep malware analysis sandbox
How to use it
Upload samples for deep behavior analysis with detailed reports; free community tier.
any Web
https://any.run/
Interactive cloud sandbox
How to use it
Detonate a file or link in a live Windows VM you can click through in the browser — great for phishing triage.
CAPEv2 GitHub
https://github.com/kevoreilly/CAPEv2/
Open-source code repository
How to use it
Open the repo page, read the README for install instructions (usually a git clone or pip install command), then run it in a terminal. Check the 'Issues' and 'Releases' tabs for updates.
openphish Web
https://openphish.com/
Phishing feed
How to use it
Use the free community feed of detected phishing URLs for blocklists and verification.
phishtank Web
https://www.phishtank.com/
Community phishing database
How to use it
Verify and report phishing URLs; free API for checking links.
urlvoid Web
https://www.urlvoid.com/
URL reputation checker
How to use it
Check a domain against 30+ blocklist engines plus WHOIS/DNS info.
sucuri Web
https://sitecheck.sucuri.net/
Website malware scanner
How to use it
Scan a site for malware, blacklisting and outdated software.
capa GitHub
https://github.com/mandiant/capa/
Open-source code repository
How to use it
Open the repo page, read the README for install instructions (usually a git clone or pip install command), then run it in a terminal. Check the 'Issues' and 'Releases' tabs for updates.
stringsifter GitHub
https://github.com/mandiant/stringsifter/
Open-source code repository
How to use it
Open the repo page, read the README for install instructions (usually a git clone or pip install command), then run it in a terminal. Check the 'Issues' and 'Releases' tabs for updates.
rules GitHub
https://github.com/Yara-Rules/rules/
Open-source code repository
How to use it
Open the repo page, read the README for install instructions (usually a git clone or pip install command), then run it in a terminal. Check the 'Issues' and 'Releases' tabs for updates.
github Web
https://virustotal.github.io/yara/
YARA documentation
How to use it
Learn YARA rule syntax to classify malware by pattern; test rules against samples locally.
yara GitHub
https://github.com/VirusTotal/yara/
Open-source code repository
How to use it
Open the repo page, read the README for install instructions (usually a git clone or pip install command), then run it in a terminal. Check the 'Issues' and 'Releases' tabs for updates.
yeti GitHub
https://github.com/yeti-platform/yeti/
Open-source code repository
How to use it
Open the repo page, read the README for install instructions (usually a git clone or pip install command), then run it in a terminal. Check the 'Issues' and 'Releases' tabs for updates.
yeti-platform Web
https://yeti-platform.io/
yeti-platform — Threat Intelligence resource
How to use it
Open the site, use its search or query interface with the identifier you have (name, number, domain or keyword depending on the tool), then export or record the results for your research notes.
thehive-project Web
https://thehive-project.org/
TheHive incident-response platform
How to use it
Self-host TheHive + Cortex to manage alerts, cases and automated analyzers as a SOC team.
TheHive GitHub
https://github.com/TheHive-Project/TheHive/
Open-source code repository
How to use it
Open the repo page, read the README for install instructions (usually a git clone or pip install command), then run it in a terminal. Check the 'Issues' and 'Releases' tabs for updates.
Cortex GitHub
https://github.com/TheHive-Project/Cortex/
Open-source code repository
How to use it
Open the repo page, read the README for install instructions (usually a git clone or pip install command), then run it in a terminal. Check the 'Issues' and 'Releases' tabs for updates.
awesome-threat-intelligence GitHub
https://github.com/hslatman/awesome-threat-intelligence/
Open-source code repository
How to use it
Open the repo page, read the README for install instructions (usually a git clone or pip install command), then run it in a terminal. Check the 'Issues' and 'Releases' tabs for updates.