Find Indicators of compromise (IOCs) from an IP address

GreyNoise

Internet scanner reputation intelligence

SpiderFoot

Automated OSINT reconnaissance framework

VirusTotal

Analyze files, URLs, domains, and IPs

Wireshark

Network protocol analyzer

urlscan.io

Scan and analyze URLs safely

ANY.RUN Threat Intelligence Lookup

ANY.RUN sandboxed runs IOC lookup

AbuseIPDB

a community IP reputation database for checking and reporting abusive interne

AlienVault OTX

a community threat intelligence exchange for pulses, indicators, malware, and

Anomali ThreatStream

Anomali TIP and feed management platform

Blacklist Checker

Check IPs and domains against 100+ DNS blacklists

Blocklist.de

Check whether an IP is a reported attack source

Burp Suite

a commercial web security testing platform for proxying, scanning, and analyz

CIRCL Passive DNS

CIRCL passive DNS service for researchers

CVE Details

a searchable vulnerability database for CVEs, vendors, products, versions, an

Can I Take Over XYZ

a community-maintained reference for identifying services vulnerable to subdo

Cisco Talos Intelligence

a threat reputation portal for IPs, domains, malware, vulnerabilities, and sp

Cisco Umbrella Investigate

Cisco DNS-resolver threat intel

Cortex

an observable analysis and active response engine used with TheHive and secur

Criminal IP

CTI search engine scoring IPs and domains for threats

CrowdSec CTI

Crowdsourced IP reputation and threat intelligence platform

CrowdSec Console

Community-driven IPS and IP reputation

CyberChef

a browser-based data transformation workbench for decoding, parsing, hashing,

Cyberbro

Extract IOCs from raw text and enrich them across reputation services

DFIR Platform

API toolkit for phishing triage, IOC enrichment and BEC investigation

DNSChecker Malicious

Cisco Talos free reputation lookup

DShield

Query attack reports and targeted ports for an IP

Exploit-DB

a public exploit archive maintained by Offensive Security for vulnerability r

Farsight DNSDB

Commercial passive DNS by DomainTools

Feodo Tracker

an abuse.ch tracker for botnet command-and-control indicators associated with

FireHOL IP Lists

Aggregated IP blocklists and threat feeds with history

FortiGuard Web Filter Lookup

Look up a URL, domain or IP reputation and category

FraudGuard.io

IP reputation and VPN/TOR detection API

Google Safe Browsing

a Google service and API for checking URLs against unsafe web resource lists

Greenbone Community Edition

an open-source vulnerability scanning stack for identifying known issues acro

GreyNoise Visualizer

GreyNoise scan-trend visualisation

Group-IB Threat Intelligence

Russian-region-focused TI platform

Grype

a vulnerability scanner for container images, filesystems, and software bills

HoneyDB

Honeypot threat feed of attacker IPs and bad hosts

Hunt.io

Adversary infrastructure tracking service

IBM X-Force Exchange

a threat intelligence sharing and enrichment platform for indicators, malware

IPQualityScore

Risk-scoring API for IP, email, phone, URL

IPVoid

Check an IP against DNS blacklists and reputation sources

InQuest Labs

InQuest free DFI and IOC hunting tools

Interactsh

an out-of-band interaction server used to verify blind vulnerabilities and ca

JA3 Fingerprint

Salesforce TLS client-fingerprint standard

JARM Fingerprint Hash

Salesforce TLS server-fingerprint tool

Jaeles

a signature-based web application scanner for detecting security issues and e

Kaspersky Threat Intelligence Portal

Kaspersky free IOC reputation portal

MISP

an open-source threat intelligence platform for sharing indicators, events, g

Maltrail

Detect traffic to malicious domains and IPs from blacklists

Malwarebytes Labs

a threat research publication and malware intelligence source for campaigns a

Mandiant Advantage

Mandiant TI and APT analytics platform

MetaDefender Cloud

Multi-engine scan of files, hashes, IPs and URLs

Microsoft Defender Threat Intelligence

Microsoft passive DNS and TI graph

Mnemonic ARGUS

Mnemonic passive DNS and TI platform

Multi-RBL Check

Free multi-DNSBL and FCrDNS check for mail servers

NVD

the U.S. National Vulnerability Database for CVEs, CPEs, CVSS scores, and ref

Nikto

a web server scanner for dangerous files, outdated software, and common misco

Nuclei

a template-based vulnerability scanner used to detect misconfigurations and e

Nuclei Templates

a community template library used by Nuclei to identify vulnerabilities and m