mirror of
https://github.com/lockfale/OSINT-Framework.git
synced 2026-08-21 13:22:24 +02:00
Apply full Threat Intelligence enrichment payload (THE-168)
Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
s0lray
+662
-47
@@ -17241,22 +17241,82 @@
|
||||
{
|
||||
"name": "SecAI.ai",
|
||||
"type": "url",
|
||||
"url": "https://secai.ai/research"
|
||||
"url": "https://secai.ai/research",
|
||||
"description": "Security research platform providing threat intelligence, vulnerability analysis, and cybersecurity insights with focus on emerging threats.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Security research and threat intelligence",
|
||||
"input": "Threat indicator or research topic",
|
||||
"output": "Research articles and threat analysis",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Passive threat intelligence platform",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"invitationOnly": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "https://openphish.com/feed.txt",
|
||||
"type": "url",
|
||||
"url": "https://openphish.com/feed.txt"
|
||||
"url": "https://openphish.com/feed.txt",
|
||||
"description": "Real-time phishing URL feed providing confirmed malicious phishing sites updated continuously.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Phishing URL detection",
|
||||
"input": "Feed subscription or URL lookup",
|
||||
"output": "Phishing URLs and malicious domains",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Passive feed consumption of public phishing data",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"api": true,
|
||||
"invitationOnly": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "PhishTank",
|
||||
"type": "url",
|
||||
"url": "https://www.phishtank.com/"
|
||||
"url": "https://www.phishtank.com/",
|
||||
"description": "Community-driven phishing URL database where users submit and verify suspected phishing sites.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Phishing site verification",
|
||||
"input": "Phishing URL or suspected malicious site",
|
||||
"output": "Phishing status and community verification votes",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Passive lookup of community-reported database",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"editUrl": true,
|
||||
"api": true,
|
||||
"invitationOnly": false,
|
||||
"registration": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "PhishStats",
|
||||
"type": "url",
|
||||
"url": "https://phishstats.info/"
|
||||
"url": "https://phishstats.info/",
|
||||
"description": "Phishing detection and analysis platform providing statistics on campaigns and domain intelligence.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Phishing campaign analysis",
|
||||
"input": "Domain, IP, or keyword",
|
||||
"output": "Campaign tracking and threat profiles",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Passive querying of phishing statistics database",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"api": true,
|
||||
"invitationOnly": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"deprecated": false
|
||||
}
|
||||
]
|
||||
},
|
||||
@@ -17267,37 +17327,142 @@
|
||||
{
|
||||
"name": "Jager",
|
||||
"type": "url",
|
||||
"url": "https://github.com/sroberts/jager"
|
||||
"url": "https://github.com/sroberts/jager",
|
||||
"description": "Python IOC aggregation and analysis tool for collecting and organizing security indicators.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "IOC collection and aggregation",
|
||||
"input": "IOC feeds or indicator lists",
|
||||
"output": "Aggregated IOC database in standardized format",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Local processing of public feeds",
|
||||
"localInstall": true,
|
||||
"googleDork": false,
|
||||
"api": true,
|
||||
"invitationOnly": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "IOC Parser",
|
||||
"type": "url",
|
||||
"url": "https://github.com/armbues/ioc_parser"
|
||||
"url": "https://github.com/armbues/ioc_parser",
|
||||
"description": "Python library for extracting and parsing IOCs from raw text and security reports.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "IOC extraction from reports",
|
||||
"input": "Raw text or security reports",
|
||||
"output": "Parsed IOCs in structured format",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Local text analysis without network interaction",
|
||||
"localInstall": true,
|
||||
"googleDork": false,
|
||||
"invitationOnly": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "Cacador",
|
||||
"type": "url",
|
||||
"url": "https://github.com/sroberts/cacador"
|
||||
"url": "https://github.com/sroberts/cacador",
|
||||
"description": "Python tool for indicator extraction and deduplication from threat intelligence documents.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Indicator extraction and deduplication",
|
||||
"input": "Documents and threat feeds",
|
||||
"output": "Extracted and deduplicated IOCs",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Local processing tool for passive analysis",
|
||||
"localInstall": true,
|
||||
"googleDork": false,
|
||||
"invitationOnly": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "ThreatPinch Lookup",
|
||||
"type": "url",
|
||||
"url": "https://github.com/cloudtracer/ThreatPinchLookup"
|
||||
"url": "https://github.com/cloudtracer/ThreatPinchLookup",
|
||||
"description": "Browser extension and Python tool for enriching IOCs with real-time threat intelligence.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Indicator enrichment",
|
||||
"input": "IOC or domain/IP/hash",
|
||||
"output": "Enriched threat intelligence from multiple sources",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Passive lookup of public threat intel APIs",
|
||||
"localInstall": true,
|
||||
"googleDork": false,
|
||||
"api": true,
|
||||
"invitationOnly": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "Mimir",
|
||||
"type": "url",
|
||||
"url": "https://github.com/NullArray/Mimir"
|
||||
"url": "https://github.com/NullArray/Mimir",
|
||||
"description": "IOC extraction and validation tool from security reports (unmaintained).",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "IOC extraction and validation",
|
||||
"input": "Security reports and documents",
|
||||
"output": "Validated IOCs in structured format",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Local processing tool for passive extraction",
|
||||
"localInstall": true,
|
||||
"googleDork": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": true,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false
|
||||
},
|
||||
{
|
||||
"name": "iocextract (T)",
|
||||
"type": "url",
|
||||
"url": "https://github.com/InQuest/iocextract"
|
||||
"url": "https://github.com/InQuest/iocextract",
|
||||
"description": "Python library and CLI tool for rapid IOC extraction with support for obfuscated indicators.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "IOC extraction with deobfuscation",
|
||||
"input": "Raw text with obfuscated indicators",
|
||||
"output": "Extracted IOCs including decoded variants",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Local text parsing without network interaction",
|
||||
"localInstall": true,
|
||||
"googleDork": false,
|
||||
"invitationOnly": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "ThreatIngestor (T)",
|
||||
"type": "url",
|
||||
"url": "https://github.com/InQuest/ThreatIngestor"
|
||||
"url": "https://github.com/InQuest/ThreatIngestor",
|
||||
"description": "Modular IOC ingestion platform for automated threat indicator extraction from multiple sources.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Automated IOC collection and enrichment",
|
||||
"input": "Multiple threat feeds and RSS sources",
|
||||
"output": "Aggregated and enriched IOCs in repository",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Passive aggregation of public threat feeds",
|
||||
"localInstall": true,
|
||||
"googleDork": false,
|
||||
"api": true,
|
||||
"invitationOnly": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"deprecated": false
|
||||
}
|
||||
]
|
||||
},
|
||||
@@ -17308,12 +17473,42 @@
|
||||
{
|
||||
"name": "Malware Exploit TTP Database",
|
||||
"type": "url",
|
||||
"url": "https://www.pwnmalw.re/"
|
||||
"url": "https://www.pwnmalw.re/",
|
||||
"description": "Malware exploit database documenting security vulnerabilities in malware families (offline).",
|
||||
"status": "down",
|
||||
"pricing": "free",
|
||||
"bestFor": "Malware exploit research",
|
||||
"input": "Malware name or exploit query",
|
||||
"output": "Exploit documentation and vulnerability details",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Passive lookup when functional",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": true
|
||||
},
|
||||
{
|
||||
"name": "Mitre TTPs",
|
||||
"type": "url",
|
||||
"url": "https://attack.mitre.org/wiki/All_Techniques"
|
||||
"url": "https://attack.mitre.org/",
|
||||
"description": "MITRE ATT&CK framework: globally-accessible knowledge base of adversary tactics and techniques.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Threat modeling and TTP analysis",
|
||||
"input": "Search for tactics, techniques, or threat groups",
|
||||
"output": "Technique descriptions and mitigation strategies",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Passive research of public threat intelligence",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": true,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
}
|
||||
]
|
||||
},
|
||||
@@ -17328,12 +17523,42 @@
|
||||
{
|
||||
"name": "Global Terrorism Database",
|
||||
"type": "url",
|
||||
"url": "https://www.start.umd.edu/research-projects/global-terrorism-database-gtd"
|
||||
"url": "https://www.start.umd.edu/research-projects/global-terrorism-database-gtd",
|
||||
"description": "Academic database of terrorist attacks maintained by START at University of Maryland.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Terrorism research and analysis",
|
||||
"input": "Search by attack, group, or date",
|
||||
"output": "Terrorist attack records and analysis data",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Passive academic research database",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "START Consortium for the Study of Terrorism and Responses to Terrorism",
|
||||
"type": "url",
|
||||
"url": "https://www.start.umd.edu/"
|
||||
"url": "https://www.start.umd.edu/",
|
||||
"description": "National Consortium conducting research on terrorism causes, consequences, and responses.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Terrorism research and education",
|
||||
"input": "Research topics and publications",
|
||||
"output": "Academic research and threat intelligence",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Passive academic research access",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
}
|
||||
]
|
||||
},
|
||||
@@ -17344,17 +17569,62 @@
|
||||
{
|
||||
"name": "CSIS Warfare, Irregular Threats, and Terrorism Program",
|
||||
"type": "url",
|
||||
"url": "https://www.csis.org/programs/warfare-irregular-threats-and-terrorism-program"
|
||||
"url": "https://www.csis.org/programs/warfare-irregular-threats-and-terrorism-program",
|
||||
"description": "Research program analyzing terrorism, cyber threats, and irregular warfare.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Terrorism and threat analysis research",
|
||||
"input": "Research topics and reports",
|
||||
"output": "Reports and analysis on terrorism and warfare",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Passive access to public research",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "Institute for Strategic Dialogue",
|
||||
"type": "url",
|
||||
"url": "https://www.isdglobal.org/"
|
||||
"url": "https://www.isdglobal.org/",
|
||||
"description": "International research organization studying conflict, extremism, and social change.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Extremism and conflict research",
|
||||
"input": "Research topics and publications",
|
||||
"output": "Research reports and analysis",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Passive access to public research",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "RAND Terrorism Research",
|
||||
"type": "url",
|
||||
"url": "https://www.rand.org/topics/terrorism.html"
|
||||
"url": "https://www.rand.org/topics/terrorism.html",
|
||||
"description": "RAND Corporation's collection of research and analysis on terrorism topics.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Terrorism research and policy analysis",
|
||||
"input": "Search for terrorism research",
|
||||
"output": "Academic papers and research findings",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Passive access to public research",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
}
|
||||
]
|
||||
},
|
||||
@@ -17365,17 +17635,62 @@
|
||||
{
|
||||
"name": "OFAC Sanctions List Search",
|
||||
"type": "url",
|
||||
"url": "https://sanctionssearch.ofac.treas.gov/"
|
||||
"url": "https://sanctionssearch.ofac.treas.gov/",
|
||||
"description": "U.S. Treasury tool for searching SDN and sanctions lists with approximate string matching.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Sanctions list lookups",
|
||||
"input": "Person or entity name",
|
||||
"output": "Sanctions status and entity information",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Government database lookup with approximate matching",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": true,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "OpenSanctions",
|
||||
"type": "url",
|
||||
"url": "https://www.opensanctions.org/"
|
||||
"url": "https://www.opensanctions.org/",
|
||||
"description": "Platform aggregating global sanctions, watchlists, and PEP data from 329 sources.",
|
||||
"status": "live",
|
||||
"pricing": "freemium",
|
||||
"bestFor": "Sanctions and compliance research",
|
||||
"input": "Person, company, or entity name",
|
||||
"output": "Sanctions status and entity details",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Passive lookup of aggregated public data",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": true,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "UN Security Council Consolidated List",
|
||||
"type": "url",
|
||||
"url": "https://main.un.org/securitycouncil/en/content/un-sc-consolidated-list"
|
||||
"url": "https://main.un.org/securitycouncil/en/content/un-sc-consolidated-list",
|
||||
"description": "Official UN Security Council list of designated individuals and entities.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "UN sanctions verification",
|
||||
"input": "Person or entity name",
|
||||
"output": "UN designation status",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Passive lookup of official UN data",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
}
|
||||
]
|
||||
},
|
||||
@@ -17386,7 +17701,22 @@
|
||||
{
|
||||
"name": "Terrorist Finance Tracking Program",
|
||||
"type": "url",
|
||||
"url": "https://home.treasury.gov/policy-issues/terrorism-and-illicit-finance/terrorist-finance-tracking-program-tftp"
|
||||
"url": "https://home.treasury.gov/policy-issues/terrorism-and-illicit-finance/terrorist-finance-tracking-program-tftp",
|
||||
"description": "U.S. Treasury program tracking terrorist financing and money laundering.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Terrorist financing intelligence",
|
||||
"input": "Financial or entity information",
|
||||
"output": "Financing intelligence and reports",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Government resource access",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -17395,35 +17725,95 @@
|
||||
{
|
||||
"name": "IBM X-Force Exchange",
|
||||
"type": "url",
|
||||
"url": "https://exchange.xforce.ibmcloud.com/new"
|
||||
"url": "https://exchange.xforce.ibmcloud.com/",
|
||||
"description": "Collaborative threat intelligence platform with malware, vulnerability, and campaign data.",
|
||||
"status": "live",
|
||||
"pricing": "freemium",
|
||||
"bestFor": "Malware and threat intelligence",
|
||||
"input": "IOC, domain, or malware sample",
|
||||
"output": "Threat analysis and intelligence reports",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Passive querying of threat database",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": true,
|
||||
"editUrl": false,
|
||||
"api": true,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "Malware Information Sharing Platform",
|
||||
"type": "url",
|
||||
"url": "https://www.misp-project.org/"
|
||||
"url": "https://www.misp-project.org/",
|
||||
"description": "Open-source platform for collecting, storing, and sharing cyber threat indicators and malware data.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Threat intelligence sharing",
|
||||
"input": "Threat indicators and malware samples",
|
||||
"output": "Structured threat intelligence and correlations",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Local platform for passive sharing",
|
||||
"localInstall": true,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": true,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "Malware Patrol",
|
||||
"type": "url",
|
||||
"url": "https://www.malwarepatrol.net/integrations-formats-threat-intelligence-feed-integration/"
|
||||
"url": "https://www.malwarepatrol.net/",
|
||||
"description": "Threat intelligence feed service providing malware samples, URLs, domains, and IOC data.",
|
||||
"status": "live",
|
||||
"pricing": "freemium",
|
||||
"bestFor": "Malware IOC and feed intelligence",
|
||||
"input": "IOC queries or feed subscriptions",
|
||||
"output": "Malware hashes, URLs, and threat intel",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Passive consumption of threat feeds",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": true,
|
||||
"editUrl": false,
|
||||
"api": true,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "AlienVault OTX",
|
||||
"type": "url",
|
||||
"url": "https://otx.alienvault.com/"
|
||||
"url": "https://otx.alienvault.com/",
|
||||
"description": "Crowd-sourced threat intelligence platform with 180K+ participants sharing 19M+ daily threats.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Community threat intelligence",
|
||||
"input": "IOC, domain, IP, or search query",
|
||||
"output": "Community threat pulses and analysis",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Passive community threat data sharing",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": true,
|
||||
"editUrl": false,
|
||||
"api": true,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "FireHOL IP Lists ",
|
||||
"type": "url",
|
||||
"url": "https://iplists.firehol.org/",
|
||||
"description": "Collection of firewall-friendly IP lists for blocking malicious and spam sources.",
|
||||
"description": "Collection of firewall-friendly IP blacklists for blocking malicious and spam sources.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Block malicious/spam IP sources",
|
||||
"input": "IP address or list download",
|
||||
"bestFor": "IP reputation and blocking",
|
||||
"input": "IP address or list subscription",
|
||||
"output": "Blacklist membership status",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Passive lookup of public IP reputation lists.",
|
||||
"opsecNote": "Passive lookup of public reputation lists",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
@@ -17435,72 +17825,282 @@
|
||||
{
|
||||
"name": "Maltiverse",
|
||||
"type": "url",
|
||||
"url": "https://maltiverse.com/start"
|
||||
"url": "https://maltiverse.com/",
|
||||
"description": "Threat intelligence platform aggregating 100+ sources with real-time IOC scoring.",
|
||||
"status": "live",
|
||||
"pricing": "freemium",
|
||||
"bestFor": "IOC aggregation and scoring",
|
||||
"input": "IOC or threat indicator",
|
||||
"output": "Threat scores and context",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Passive aggregation of threat data",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": true,
|
||||
"editUrl": false,
|
||||
"api": true,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "Malpedia",
|
||||
"type": "url",
|
||||
"url": "https://malpedia.caad.fkie.fraunhofer.de/library"
|
||||
"url": "https://malpedia.caad.fkie.fraunhofer.de/",
|
||||
"description": "Free collaborative malware database from Fraunhofer FKIE with 600+ malware families.",
|
||||
"status": "live",
|
||||
"pricing": "freemium",
|
||||
"bestFor": "Malware family identification",
|
||||
"input": "Malware sample or family name",
|
||||
"output": "Malware family analysis and YARA rules",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Passive malware research database",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": true,
|
||||
"editUrl": false,
|
||||
"api": true,
|
||||
"invitationOnly": true,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "Project Honey Pot",
|
||||
"type": "url",
|
||||
"url": "https://www.projecthoneypot.org/"
|
||||
"url": "https://www.projecthoneypot.org/",
|
||||
"description": "Distributed honeypot project tracking email harvesters, spam servers, and malicious IPs.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Spam and harvester tracking",
|
||||
"input": "IP address or email domain",
|
||||
"output": "Harvester and spam activity records",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Passive honeypot intelligence",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": true,
|
||||
"editUrl": false,
|
||||
"api": true,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "Cymon Open Threat Intelligence",
|
||||
"type": "url",
|
||||
"url": "https://cymon.io/"
|
||||
"url": "https://cymon.io/",
|
||||
"description": "Largest open tracker of malware, phishing, botnets containing 6M+ malicious IPs.",
|
||||
"status": "live",
|
||||
"pricing": "freemium",
|
||||
"bestFor": "IP threat tracking",
|
||||
"input": "IP address or threat indicator",
|
||||
"output": "Malware and threat reports",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Passive threat database queries",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": true,
|
||||
"editUrl": false,
|
||||
"api": true,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "mlsecproject / combine",
|
||||
"type": "url",
|
||||
"url": "https://github.com/mlsecproject/combine"
|
||||
"url": "https://github.com/mlsecproject/combine",
|
||||
"description": "Tool for gathering and normalizing threat intelligence feeds from public sources.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Threat feed aggregation",
|
||||
"input": "Multiple threat intelligence feeds",
|
||||
"output": "Normalized IOC data in CSV or CRITs format",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Local processing of public feeds",
|
||||
"localInstall": true,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "hostintel - keithjjones Github",
|
||||
"type": "url",
|
||||
"url": "https://github.com/keithjjones/hostintel"
|
||||
"url": "https://github.com/keithjjones/hostintel",
|
||||
"description": "Modular Python application to collect host and malicious IP intelligence.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Host intelligence gathering",
|
||||
"input": "IP, FQDN, or domain name",
|
||||
"output": "Intelligence data in CSV format",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Local tool for passive host analysis",
|
||||
"localInstall": true,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "massive-octo-spice - csirtgadgets Github",
|
||||
"type": "url",
|
||||
"url": "https://github.com/csirtgadgets/massive-octo-spice"
|
||||
"url": "https://github.com/csirtgadgets/massive-octo-spice",
|
||||
"description": "CSIRT threat intelligence platform (deprecated - use bearded-avenger v3 instead).",
|
||||
"status": "degraded",
|
||||
"pricing": "free",
|
||||
"bestFor": "Legacy CSIRT intelligence platform",
|
||||
"input": "Threat intelligence feeds",
|
||||
"output": "Aggregated threat data",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Local platform for threat aggregation",
|
||||
"localInstall": true,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": true
|
||||
},
|
||||
{
|
||||
"name": "Scam Database",
|
||||
"type": "url",
|
||||
"url": "https://www.scamdb.net"
|
||||
"url": "https://www.scamdb.net/",
|
||||
"description": "User-contributed database of scam reports searchable by phone, email, and website.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Scam and fraud reporting",
|
||||
"input": "Phone, email, or website",
|
||||
"output": "Unverified scam reports and details",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Passive lookup of community reports",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": true,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "Bot Scout",
|
||||
"type": "url",
|
||||
"url": "https://botscout.com/"
|
||||
"url": "https://botscout.com/",
|
||||
"description": "Service tracking bot signatures (names, IPs, emails) to prevent automated spam and abuse.",
|
||||
"status": "live",
|
||||
"pricing": "freemium",
|
||||
"bestFor": "Bot and spam detection",
|
||||
"input": "IP, email, or username",
|
||||
"output": "Bot activity and spam records",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Passive honeypot-based detection",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": true,
|
||||
"editUrl": false,
|
||||
"api": true,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "APTnotes",
|
||||
"type": "url",
|
||||
"url": "https://github.com/aptnotes/data"
|
||||
"url": "https://github.com/aptnotes/data",
|
||||
"description": "Repository of public documents, whitepapers, and articles about APT campaigns.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "APT research and threat analysis",
|
||||
"input": "Search APT campaign documents",
|
||||
"output": "Threat reports and analysis",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Passive access to public threat research",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "HoneyDB",
|
||||
"type": "url",
|
||||
"url": "https://riskdiscovery.com/honeydb/"
|
||||
"url": "https://honeydb.io/",
|
||||
"description": "Honeypot network providing real-time IoT and server threat intelligence via REST API.",
|
||||
"status": "live",
|
||||
"pricing": "freemium",
|
||||
"bestFor": "IoT honeypot intelligence",
|
||||
"input": "IP address or attack queries",
|
||||
"output": "Honeypot interaction logs and threat data",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Passive honeypot-based intelligence",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": true,
|
||||
"editUrl": false,
|
||||
"api": true,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "Pulsedive",
|
||||
"type": "url",
|
||||
"url": "https://pulsedive.com"
|
||||
"url": "https://pulsedive.com/",
|
||||
"description": "Free threat intelligence platform for enriching IPs, URLs, domains, and IOCs from OSINT feeds.",
|
||||
"status": "live",
|
||||
"pricing": "freemium",
|
||||
"bestFor": "IOC enrichment and risk scoring",
|
||||
"input": "IP, URL, domain, or IOC",
|
||||
"output": "Enriched threat intelligence and risk factors",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Passive querying of enrichment database",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": true,
|
||||
"editUrl": false,
|
||||
"api": true,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "Mr.Looquer IOC Feed - 1st Dual Stack Threat Feed",
|
||||
"type": "url",
|
||||
"url": "https://iocfeed.mrlooquer.com"
|
||||
"url": "https://iocfeed.mrlooquer.com/",
|
||||
"description": "Threat intelligence feed providing IOC data with IPv4/IPv6 dual stack support.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "IOC threat feed access",
|
||||
"input": "Feed subscription",
|
||||
"output": "IOC threat intelligence feed",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Passive threat feed consumption",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "REScure Cyber Threat Intelligence Project",
|
||||
"type": "url",
|
||||
"url": "https://rescure.me/feeds.html"
|
||||
"url": "https://rescure.me/",
|
||||
"description": "Community-driven cyber threat intelligence project providing IOC feeds and research.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Threat intelligence feeds",
|
||||
"input": "IOC feed subscription",
|
||||
"output": "IOC threat intelligence",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Passive threat feed access",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "Attack Surface / Security Testing",
|
||||
@@ -17509,7 +18109,22 @@
|
||||
{
|
||||
"name": "ImmuniWeb",
|
||||
"type": "url",
|
||||
"url": "https://www.immuniweb.com/"
|
||||
"url": "https://www.immuniweb.com/",
|
||||
"description": "AI-powered application security platform for web penetration testing and vulnerability scanning.",
|
||||
"status": "live",
|
||||
"pricing": "freemium",
|
||||
"bestFor": "Web security testing and scanning",
|
||||
"input": "Web application or target URL",
|
||||
"output": "Vulnerability reports and risk assessment",
|
||||
"opsec": "active",
|
||||
"opsecNote": "Performs actual penetration testing and scanning - generates server logs",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": true,
|
||||
"editUrl": false,
|
||||
"api": true,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -17787,7 +18402,7 @@
|
||||
"url": "https://themanyhats.club/centralised-place-for-privacy-resources/"
|
||||
},
|
||||
{
|
||||
"name": "The Hitchhiker\u2019s Guide to Online Anonymity",
|
||||
"name": "The Hitchhiker’s Guide to Online Anonymity",
|
||||
"type": "url",
|
||||
"url": "https://anonymousplanet.org/guide/"
|
||||
},
|
||||
@@ -18068,4 +18683,4 @@
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user