Threat Intelligence Platforms

A platform for accessing threat intelligence and collaborating on cyber threats.

Yara rule generator using VirusTotal code similarity feature code-similar-to.

A project that detects malicious SSL connections by identifying and blacklisting SSL certificates used by botnet C&C servers and identifying JA3 fingerprints to detect and block malware botnet C&C communication.

A project sharing malicious URLs used for malware distribution to help protect networks.

A threat intelligence domain/IP/hash threat feeds checker that checks IPVoid, URLVoid, Virustotal, and Cymon.

Cyber Intelligence Management Platform with threat tracking, forensic artifacts, and YARA rule storage.

FraudGuard is a service that provides real-time internet traffic analysis and IP tracking to help validate usage and prevent fraud.

Malware Patrol offers a range of threat intelligence solutions, including enterprise data feeds, DNS firewall, phishing threat intelligence, and small business protection.

Repository with projects for photo and video hashing, content moderation, and signal exchange.

A Microsoft framework for secure and efficient sharing of cybersecurity information between trusted parties to reduce cybersecurity risks.

A Python library that provides an interface to query ThreatCrowd's API for threat intelligence data including email, IP, domain, and antivirus reports with built-in caching capabilities.

A knowledge base of analytics developed by MITRE based on the MITRE ATT&CK adversary model.

A list of most queried domains based on passive DNS usage across the Umbrella global network.

Facilitating exchange of information and knowledge to collectively protect against cyberattacks.

CRITs is an open source malware and threat repository for collaborative threat defense and analysis.

A Pythonic interface to the Internet Storm Center / DShield API

A comprehensive Threat Intelligence Program Management Solution for managing the entire CTI lifecycle.

A free software that calculates the security ranking of Internet Service Providers to detect malicious activities.

An IOC tracker written in Python that queries Google Custom Search Engines for various cybersecurity indicators and monitors domain status using Google Safe Browsing APIs.

IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol, with a focus on incident handling automation and threat intelligence processing.

Check the reputation of an IP address to identify potential threats.

PyIOCe is a Python-based OpenIOC editor that enables security professionals to create, edit, and manage Indicators of Compromise for threat intelligence and incident response operations.

Aggregates security threats from online sources and outputs to various formats.

GCTI's open-source detection signatures for malware and threat detection