Threat Intelligence OSINT tools

38 verified tools for Threat Intelligence.

38 tools · Version française

• abuse.ch Huntingalso written abuse ch Hunting, abuse.chHuntingCross-search over the abuse.ch feeds: malicious URLs, samples, botnet command servers and SSL fingerprints, from one of the most cited non-profit sources.free
• APT Groups and OperationsThe community reference spreadsheet mapping attack groups to the names each vendor gives them, with the public reports behind each attribution.free
• BI.ZONE Threat Intelligencealso written BI ZONE Threat IntelligenceThreat portal with strong coverage of groups active in the post-Soviet space, an area where Western sources are thin.freemium
• CIRT Default Password DatabaseCatalogue of factory default credentials by manufacturer and model, long-standing and still maintained.free
• Dark Web InformerDatabase of threat actors observed on criminal forums and leak sites, with their aliases, claimed victims and activity timeline.free
• ETDA Threat Actor EncyclopediaEncyclopaedia of attack groups with their aliases, tools and campaigns. Its main value is untangling the many names the industry gives the same group.free
• Feodo Trackeralso written FeodoTrackerTracks command-and-control servers of banking trojans such as Emotet, Dridex and TrickBot.free
• GitGuardian Public Monitoringalso written Git Guardian Public MonitoringWatches public repositories for credentials leaked by an organisation's developers. Catches keys published by mistake, often within minutes.freemium
• Global Terrorism DatabaseAcademic database of the University of Maryland cataloguing terrorist attacks worldwide since 1970, with place, date, method and attribution.free
• GreyNoisealso written Grey NoiseThreat intelligence platform that classifies IP addresses scanning the internet as malicious, benign, or noise using a global sensor network. 50 free daily API calls.freemium
• GTFOBinsalso written GTFO BinsCurated list of Unix binaries that can bypass local security restrictions in misconfigured systems.free
• HoneyDBalso written Honey DBAggregates activity observed by a network of community honeypots, and publishes the most active attacking addresses.freemium
• IBM X-Force Exchangealso written IBM X Force ExchangeReputation and threat intelligence portal on IP addresses, domains, files and vulnerabilities, with shared collections.freemium
• LazarusholicSpecialised archive on North Korean operations: samples, indicators and reports gathered in one place, where the material is usually scattered.free
• LeakIXalso written Leak IXSearch engine for exposed services and leaked data: indexes misconfigured databases, open directories, exposed files.freemium
• LOLBASLiving Off The Land Binaries and Scripts: catalog of Windows binaries usable for offensive purposes.free
• MalpediaAcademic reference on malware families and the groups that use them, maintained by Fraunhofer. Each entry cites the public reports it rests on.free
• MaltiverseIoC aggregation platform: correlates threat indicators from 100+ feeds. Free API access.freemium
• Malware Patrolalso written MalwarePatrolThreat feeds on malicious domains, ransomware and command-and-control servers, with a free tier.freemium
• MISPOpen platform for sharing threat indicators between organisations, with correlation and standardised export formats.free
• MISP Galaxyalso written MISPGalaxyOpen, machine-readable knowledge base of threat actors, tools and techniques, used to share intelligence between organisations in a common vocabulary.free
• MITRE ATT&CKalso written MITREATT&CKGlobal knowledge base of adversary tactics and techniques based on real-world observations. The industry standard framework for describing and categorizing cyber attack behaviors.free
• NVD (NIST)also written NVD(NIST)United States national vulnerability database: official reference for CVE identifiers, with severity scores and affected products.free
• OPENHUNTING.IO Threat Libraryalso written OPENHUNTING IO Threat LibraryOpen library of threat actors, malware families and campaigns, cross-referenced and sourced. A free alternative to commercial platforms.free
• OpenPhishalso written Open PhishReal-time phishing intelligence platform providing curated phishing URLs and targets. Free feed of active phishing sites updated continuously for threat analysts and security teams.freemium
• OSVOpen vulnerability database for software dependencies, queryable by package and version across dozens of ecosystems.free
• OTX AlienVaultalso written OTX Alien Vault, OTXAlienVaultOpen Threat eXchange — world's largest open threat intelligence community with 100k+ participants sharing 20M+ threat indicators. Search IPs, domains, hashes, CVEs and subscribe to threat pulses.free
• PhishStatsalso written Phish StatsContinuously updated phishing database, searchable by URL, IP, domain or ASN, with a public feed.free
• PhishTankalso written Phish TankCommunity-based phishing URL database. Verify and report phishing sites, access real-time feeds of known phishing URLs. API available for integration into security tools.free
• PulsediveThreat intelligence platform for enriching IPs, domains, URLs, and hashes — correlating risk scores, linked threats, and historical context from 30+ sources. 30 free lookups/day.freemium
• Shadowserver Dashboardalso written ShadowserverDashboardPublic statistics from a non-profit that scans the internet daily: exposed services, infections and vulnerabilities, broken down by country and network.free
• Shodan Monitoralso written ShodanMonitorContinuous monitoring of your internet-exposed assets via Shodan: alerts on new open ports and vulnerabilities.freemium
• SilentPushalso written Silent PushPredictive threat intelligence and attack surface management platform. Identifies attacker infrastructure before attacks launch using DNS, hosting and behavioral patterns.freemium
• SOCRadaralso written SOC RadarExtended threat intelligence platform with free community tools for dark web monitoring, breach alerts, vulnerability intelligence, and company digital footprint analysis.freemium
• Thales Cyberthreat HandbookAttacker profiles published by Thales: motivations, sectors targeted and techniques used, written for decision-makers rather than analysts.free
• ThreatFox (abuse.ch)also written Threat Fox (abuse.ch), ThreatFox (abuse ch), ThreatFox(abuse.ch)Free threat intelligence platform by abuse.ch for sharing indicators of compromise (IOCs) — IPs, domains, URLs, hashes — with community attribution and MITRE ATT&CK mapping.free
• URLhaus (abuse.ch)also written UR Lhaus (abuse.ch), URLhaus (abuse ch), URLhaus(abuse.ch)Community-driven database of malicious URLs used for malware distribution. Searchable by URL, domain, IP, CIDR, or hash. Integrates with threat feeds and blocklists.free
• VirusTotal Graphalso written Virus Total Graph, VirusTotalGraphVisual threat intelligence graph built on VirusTotal data. Map relationships between malware samples, domains, IPs, URLs and files to understand attacker infrastructure visually.freemium