Find Indicators of compromise (IOCs) from a file hash

VirusTotal

Analyze files, URLs, domains, and IPs

ANY.RUN

an interactive malware sandbox for analyzing suspicious files, URLs, and netw

ANY.RUN Threat Intelligence Lookup

ANY.RUN sandboxed runs IOC lookup

AbuseIPDB

a community IP reputation database for checking and reporting abusive interne

AlienVault OTX

a community threat intelligence exchange for pulses, indicators, malware, and

Anomali ThreatStream

Anomali TIP and feed management platform

Autopsy

a digital forensics platform for investigating disk images, filesystems, and

Cisco Talos Intelligence

a threat reputation portal for IPs, domains, malware, vulnerabilities, and sp

Cortex

an observable analysis and active response engine used with TheHive and secur

CyberChef

a browser-based data transformation workbench for decoding, parsing, hashing,

Cyberbro

Extract IOCs from raw text and enrich them across reputation services

DFIR Platform

API toolkit for phishing triage, IOC enrichment and BEC investigation

EchoTrail

Windows process prevalence and behaviour lookup

FLOSS

a FLARE tool for extracting obfuscated strings from malware and suspicious bi

Feodo Tracker

an abuse.ch tracker for botnet command-and-control indicators associated with

Google Safe Browsing

a Google service and API for checking URLs against unsafe web resource lists

Group-IB Threat Intelligence

Russian-region-focused TI platform

Hatching Triage

a malware sandbox for analyzing files, URLs, configurations, and behavioral i

Hybrid Analysis

a malware analysis platform that runs files and URLs in sandbox environments

IBM X-Force Exchange

a threat intelligence sharing and enrichment platform for indicators, malware

Imunify360 Sandbox

Palo Alto WildFire malware analysis portal

InQuest Labs

InQuest free DFI and IOC hunting tools

Intezer Analyze

a malware analysis platform that classifies files, code reuse, and threat rel

Joe Sandbox

a malware analysis sandbox for dynamic and static investigation of files, URL

Kaspersky Threat Intelligence Portal

Kaspersky free IOC reputation portal

Koodous

Android malware intelligence platform

MISP

an open-source threat intelligence platform for sharing indicators, events, g

MalShare

Community malware sample repository

MalwareBazaar

an abuse.ch malware sample exchange for searching hashes, tags, families, and

Malwarebytes Labs

a threat research publication and malware intelligence source for campaigns a

Mandiant Advantage

Mandiant TI and APT analytics platform

MetaDefender Cloud

Multi-engine scan of files, hashes, IPs and URLs

Microsoft Defender Threat Intelligence

Microsoft passive DNS and TI graph

Mobile Verification Toolkit

a mobile forensics toolkit for checking Android and iOS devices for compromis

OpenCTI

an open-source cyber threat intelligence platform for modeling entities, rela

OpenPhish

a phishing intelligence service that detects and publishes active phishing in

PhishTank

a community phishing verification service for checking and submitting suspect

Polyswarm

Decentralized multi-engine TI marketplace

Pulsedive

a threat intelligence platform for enriching indicators, domains, IPs, and UR

Pulsedive Explore

Pulsedive free pivoting interface

QiAnXin TI

QiAnXin Chinese TI portal

Recorded Future

Recorded Future TI graph and risk platform

TheHive

a scalable security incident response platform for case management and analys

TheHive Cortex Analyzers

Cortex enrichment analyzer plugin library

ThreatBook

Chinese commercial TI platform

ThreatConnect

ThreatConnect TIP and SOAR platform

ThreatFox

an abuse.ch platform for sharing malware indicators and command-and-control i

ThreatMiner

Free TI aggregator for IOC enrichment

ThreatQ

ThreatQuotient TIP and investigation platform

ThreatView.io

Free curated TI feeds in CSV form

URLhaus

an abuse.ch project tracking malware URLs, payload delivery sites, and relate

UnpacMe

Automatically unpack malware samples and extract payloads

VMRay

Hypervisor-based malware sandbox producing IOC reports

Volatility 3

a memory forensics framework for analyzing volatile memory images and artifac

YARA

a pattern matching engine for identifying malware families and binary artifac

YARAify

Community YARA hunting service

Yeti

an intelligence platform for organizing observables, indicators, entities, an

abuse.ch Hunting

Cross-platform IOC hunting over MalwareBazaar, ThreatFox, URLhaus and YARAify

abuse.ch SSL Blacklist

SSL/TLS certificate fingerprint blacklist

capa

a FLARE tool that detects capabilities in executables using static analysis r