From fa8a2bc1d1aa5c92a831a02ecc920e7c4406520f Mon Sep 17 00:00:00 2001 From: s0lray Date: Sat, 28 Mar 2026 17:09:20 -0400 Subject: [PATCH] Consolidate Threat Intelligence + Exploits & Advisories into Security Intelligence (THE-56) Merges two related top-level categories into a unified "Security Intelligence" category with 9 clear subcategories: Advisories, Attack Surface / Security Testing, Default Passwords, Exploits, IOC Tools, Phishing, Terrorism & Extremism, Threat Feeds & Platforms, and TTPs. All 62 URL entries preserved. No tools added or removed. Co-Authored-By: Paperclip --- public/arf.json | 1137 ++++++++++++++++++++++++----------------------- 1 file changed, 572 insertions(+), 565 deletions(-) diff --git a/public/arf.json b/public/arf.json index fb4e654..b4a2704 100644 --- a/public/arf.json +++ b/public/arf.json @@ -10898,7 +10898,7 @@ "deprecated": false }, { - "name": "GOVDATA - Das Datenportal für Deutschland (German)", + "name": "GOVDATA - Das Datenportal f\u00fcr Deutschland (German)", "type": "url", "url": "https://www.govdata.de/", "description": "Official German government open data portal with 120K+ datasets. Centralized access to federal, state, and local administrative data.", @@ -10918,7 +10918,7 @@ "deprecated": false }, { - "name": "Open-Data-Portal München (German)", + "name": "Open-Data-Portal M\u00fcnchen (German)", "type": "url", "url": "https://opendata.muenchen.de/", "description": "City of Munich open data portal with 331+ datasets. Provides administrative data from Munich government at city level.", @@ -11197,12 +11197,12 @@ "url": "https://www.brbpub.com/" }, { - "name": "GOVDATA - Das Datenportal für Deutschland (German)", + "name": "GOVDATA - Das Datenportal f\u00fcr Deutschland (German)", "type": "url", "url": "https://www.govdata.de/" }, { - "name": "Open-Data-Portal München (German)", + "name": "Open-Data-Portal M\u00fcnchen (German)", "type": "url", "url": "https://www.opengov-muenchen.de/" }, @@ -19609,9 +19609,89 @@ ] }, { - "name": "Exploits & Advisories", - "type": "folder", + "name": "Security Intelligence", "children": [ + { + "name": "Advisories", + "children": [ + { + "name": "Vulert: Updated Open Source Vulnerability Database", + "type": "url", + "url": "https://vulert.com/vuln-db" + }, + { + "name": "SecurityFocus", + "type": "url", + "url": "https://www.securityfocus.com/bid" + }, + { + "name": "NVD - NIST", + "type": "url", + "url": "https://nvd.nist.gov/" + }, + { + "name": "OSV Vulnerability Library", + "type": "url", + "url": "https://osv.dev/list" + }, + { + "name": "CVE Details", + "type": "url", + "url": "https://www.cvedetails.com/" + }, + { + "name": "CVE - MITRE", + "type": "url", + "url": "https://www.cve.org/" + }, + { + "name": "OWASP", + "type": "url", + "url": "https://www.owasp.org/index.php/Main_Page" + }, + { + "name": "Secunia", + "type": "url", + "url": "https://secuniaresearch.flexerasoftware.com/community/research/" + }, + { + "name": "Australian Cyber Security Centre", + "type": "url", + "url": "https://www.cyber.gov.au/" + }, + { + "name": "Canadian Centre for Cyber Security", + "type": "url", + "url": "https://www.cyber.gc.ca/" + } + ] + }, + { + "name": "Attack Surface / Security Testing", + "type": "folder", + "children": [ + { + "name": "ImmuniWeb", + "type": "url", + "url": "https://www.immuniweb.com/", + "description": "AI-powered application security platform for web penetration testing and vulnerability scanning.", + "status": "live", + "pricing": "freemium", + "bestFor": "Web security testing and scanning", + "input": "Web application or target URL", + "output": "Vulnerability reports and risk assessment", + "opsec": "active", + "opsecNote": "Performs actual penetration testing and scanning - generates server logs", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + } + ] + }, { "name": "Default Passwords", "type": "folder", @@ -19654,159 +19734,17 @@ ] }, { - "name": "Vulert: Updated Open Source Vulnerability Database", - "type": "url", - "url": "https://vulert.com/vuln-db" - }, - { - "name": "MITRE ATT&CK", - "type": "url", - "url": "https://attack.mitre.org/" - }, - { - "name": "Exploit DB", - "type": "url", - "url": "https://www.exploit-db.com/" - }, - { - "name": "Packet Storm", - "type": "url", - "url": "https://packetstormsecurity.com/" - }, - { - "name": "SecurityFocus", - "type": "url", - "url": "https://www.securityfocus.com/bid" - }, - { - "name": "NVD - NIST", - "type": "url", - "url": "https://nvd.nist.gov/" - }, - { - "name": "OSV Vulnerability Library", - "type": "url", - "url": "https://osv.dev/list" - }, - { - "name": "CVE Details", - "type": "url", - "url": "https://www.cvedetails.com/" - }, - { - "name": "CVE - MITRE", - "type": "url", - "url": "https://www.cve.org/" - }, - { - "name": "OWASP", - "type": "url", - "url": "https://www.owasp.org/index.php/Main_Page" - }, - { - "name": "Secunia", - "type": "url", - "url": "https://secuniaresearch.flexerasoftware.com/community/research/" - }, - { - "name": "Australian Cyber Security Centre", - "type": "url", - "url": "https://www.cyber.gov.au/" - }, - { - "name": "Canadian Centre for Cyber Security", - "type": "url", - "url": "https://www.cyber.gc.ca/" - } - ] - }, - { - "name": "Threat Intelligence", - "type": "folder", - "children": [ - { - "name": "Phishing", - "type": "folder", + "name": "Exploits", "children": [ { - "name": "SecAI.ai", + "name": "Exploit DB", "type": "url", - "url": "https://secai.ai/research", - "description": "Security research platform providing threat intelligence, vulnerability analysis, and cybersecurity insights with focus on emerging threats.", - "status": "live", - "pricing": "free", - "bestFor": "Security research and threat intelligence", - "input": "Threat indicator or research topic", - "output": "Research articles and threat analysis", - "opsec": "passive", - "opsecNote": "Passive threat intelligence platform", - "localInstall": false, - "googleDork": false, - "invitationOnly": false, - "registration": false, - "editUrl": false, - "api": false, - "deprecated": false + "url": "https://www.exploit-db.com/" }, { - "name": "https://openphish.com/feed.txt", + "name": "Packet Storm", "type": "url", - "url": "https://openphish.com/feed.txt", - "description": "Real-time phishing URL feed providing confirmed malicious phishing sites updated continuously.", - "status": "live", - "pricing": "free", - "bestFor": "Phishing URL detection", - "input": "Feed subscription or URL lookup", - "output": "Phishing URLs and malicious domains", - "opsec": "passive", - "opsecNote": "Passive feed consumption of public phishing data", - "localInstall": false, - "googleDork": false, - "api": true, - "invitationOnly": false, - "registration": false, - "editUrl": false, - "deprecated": false - }, - { - "name": "PhishTank", - "type": "url", - "url": "https://www.phishtank.com/", - "description": "Community-driven phishing URL database where users submit and verify suspected phishing sites.", - "status": "live", - "pricing": "free", - "bestFor": "Phishing site verification", - "input": "Phishing URL or suspected malicious site", - "output": "Phishing status and community verification votes", - "opsec": "passive", - "opsecNote": "Passive lookup of community-reported database", - "localInstall": false, - "googleDork": false, - "editUrl": true, - "api": true, - "invitationOnly": false, - "registration": false, - "deprecated": false - }, - { - "name": "PhishStats", - "type": "url", - "url": "https://phishstats.info/", - "description": "Phishing detection and analysis platform providing statistics on campaigns and domain intelligence.", - "status": "live", - "pricing": "free", - "bestFor": "Phishing campaign analysis", - "input": "Domain, IP, or keyword", - "output": "Campaign tracking and threat profiles", - "opsec": "passive", - "opsecNote": "Passive querying of phishing statistics database", - "localInstall": false, - "googleDork": false, - "api": true, - "invitationOnly": false, - "registration": false, - "editUrl": false, - "deprecated": false + "url": "https://packetstormsecurity.com/" } ] }, @@ -19957,47 +19895,87 @@ ] }, { - "name": "TTPs", + "name": "Phishing", "type": "folder", "children": [ { - "name": "Malware Exploit TTP Database", + "name": "SecAI.ai", "type": "url", - "url": "https://www.pwnmalw.re/", - "description": "Malware exploit database documenting security vulnerabilities in malware families (offline).", - "status": "down", + "url": "https://secai.ai/research", + "description": "Security research platform providing threat intelligence, vulnerability analysis, and cybersecurity insights with focus on emerging threats.", + "status": "live", "pricing": "free", - "bestFor": "Malware exploit research", - "input": "Malware name or exploit query", - "output": "Exploit documentation and vulnerability details", + "bestFor": "Security research and threat intelligence", + "input": "Threat indicator or research topic", + "output": "Research articles and threat analysis", "opsec": "passive", - "opsecNote": "Passive lookup when functional", + "opsecNote": "Passive threat intelligence platform", "localInstall": false, "googleDork": false, + "invitationOnly": false, "registration": false, "editUrl": false, "api": false, - "invitationOnly": false, - "deprecated": true + "deprecated": false }, { - "name": "Mitre TTPs", + "name": "https://openphish.com/feed.txt", "type": "url", - "url": "https://attack.mitre.org/", - "description": "MITRE ATT&CK framework: globally-accessible knowledge base of adversary tactics and techniques.", + "url": "https://openphish.com/feed.txt", + "description": "Real-time phishing URL feed providing confirmed malicious phishing sites updated continuously.", "status": "live", "pricing": "free", - "bestFor": "Threat modeling and TTP analysis", - "input": "Search for tactics, techniques, or threat groups", - "output": "Technique descriptions and mitigation strategies", + "bestFor": "Phishing URL detection", + "input": "Feed subscription or URL lookup", + "output": "Phishing URLs and malicious domains", "opsec": "passive", - "opsecNote": "Passive research of public threat intelligence", + "opsecNote": "Passive feed consumption of public phishing data", "localInstall": false, "googleDork": false, - "registration": false, - "editUrl": false, "api": true, "invitationOnly": false, + "registration": false, + "editUrl": false, + "deprecated": false + }, + { + "name": "PhishTank", + "type": "url", + "url": "https://www.phishtank.com/", + "description": "Community-driven phishing URL database where users submit and verify suspected phishing sites.", + "status": "live", + "pricing": "free", + "bestFor": "Phishing site verification", + "input": "Phishing URL or suspected malicious site", + "output": "Phishing status and community verification votes", + "opsec": "passive", + "opsecNote": "Passive lookup of community-reported database", + "localInstall": false, + "googleDork": false, + "editUrl": true, + "api": true, + "invitationOnly": false, + "registration": false, + "deprecated": false + }, + { + "name": "PhishStats", + "type": "url", + "url": "https://phishstats.info/", + "description": "Phishing detection and analysis platform providing statistics on campaigns and domain intelligence.", + "status": "live", + "pricing": "free", + "bestFor": "Phishing campaign analysis", + "input": "Domain, IP, or keyword", + "output": "Campaign tracking and threat profiles", + "opsec": "passive", + "opsecNote": "Passive querying of phishing statistics database", + "localInstall": false, + "googleDork": false, + "api": true, + "invitationOnly": false, + "registration": false, + "editUrl": false, "deprecated": false } ] @@ -20213,401 +20191,20 @@ ] }, { - "name": "IBM X-Force Exchange", - "type": "url", - "url": "https://exchange.xforce.ibmcloud.com/", - "description": "Collaborative threat intelligence platform with malware, vulnerability, and campaign data.", - "status": "live", - "pricing": "freemium", - "bestFor": "Malware and threat intelligence", - "input": "IOC, domain, or malware sample", - "output": "Threat analysis and intelligence reports", - "opsec": "passive", - "opsecNote": "Passive querying of threat database", - "localInstall": false, - "googleDork": false, - "registration": true, - "editUrl": false, - "api": true, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "Malware Information Sharing Platform", - "type": "url", - "url": "https://www.misp-project.org/", - "description": "Open-source platform for collecting, storing, and sharing cyber threat indicators and malware data.", - "status": "live", - "pricing": "free", - "bestFor": "Threat intelligence sharing", - "input": "Threat indicators and malware samples", - "output": "Structured threat intelligence and correlations", - "opsec": "passive", - "opsecNote": "Local platform for passive sharing", - "localInstall": true, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": true, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "Malware Patrol", - "type": "url", - "url": "https://www.malwarepatrol.net/", - "description": "Threat intelligence feed service providing malware samples, URLs, domains, and IOC data.", - "status": "live", - "pricing": "freemium", - "bestFor": "Malware IOC and feed intelligence", - "input": "IOC queries or feed subscriptions", - "output": "Malware hashes, URLs, and threat intel", - "opsec": "passive", - "opsecNote": "Passive consumption of threat feeds", - "localInstall": false, - "googleDork": false, - "registration": true, - "editUrl": false, - "api": true, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "AlienVault OTX", - "type": "url", - "url": "https://otx.alienvault.com/", - "description": "Crowd-sourced threat intelligence platform with 180K+ participants sharing 19M+ daily threats.", - "status": "live", - "pricing": "free", - "bestFor": "Community threat intelligence", - "input": "IOC, domain, IP, or search query", - "output": "Community threat pulses and analysis", - "opsec": "passive", - "opsecNote": "Passive community threat data sharing", - "localInstall": false, - "googleDork": false, - "registration": true, - "editUrl": false, - "api": true, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "FireHOL IP Lists ", - "type": "url", - "url": "https://iplists.firehol.org/", - "description": "Collection of firewall-friendly IP blacklists for blocking malicious and spam sources.", - "status": "live", - "pricing": "free", - "bestFor": "IP reputation and blocking", - "input": "IP address or list subscription", - "output": "Blacklist membership status", - "opsec": "passive", - "opsecNote": "Passive lookup of public reputation lists", - "localInstall": false, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": true, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "Maltiverse", - "type": "url", - "url": "https://maltiverse.com/", - "description": "Threat intelligence platform aggregating 100+ sources with real-time IOC scoring.", - "status": "live", - "pricing": "freemium", - "bestFor": "IOC aggregation and scoring", - "input": "IOC or threat indicator", - "output": "Threat scores and context", - "opsec": "passive", - "opsecNote": "Passive aggregation of threat data", - "localInstall": false, - "googleDork": false, - "registration": true, - "editUrl": false, - "api": true, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "Malpedia", - "type": "url", - "url": "https://malpedia.caad.fkie.fraunhofer.de/", - "description": "Free collaborative malware database from Fraunhofer FKIE with 600+ malware families.", - "status": "live", - "pricing": "freemium", - "bestFor": "Malware family identification", - "input": "Malware sample or family name", - "output": "Malware family analysis and YARA rules", - "opsec": "passive", - "opsecNote": "Passive malware research database", - "localInstall": false, - "googleDork": false, - "registration": true, - "editUrl": false, - "api": true, - "invitationOnly": true, - "deprecated": false - }, - { - "name": "Project Honey Pot", - "type": "url", - "url": "https://www.projecthoneypot.org/", - "description": "Distributed honeypot project tracking email harvesters, spam servers, and malicious IPs.", - "status": "live", - "pricing": "free", - "bestFor": "Spam and harvester tracking", - "input": "IP address or email domain", - "output": "Harvester and spam activity records", - "opsec": "passive", - "opsecNote": "Passive honeypot intelligence", - "localInstall": false, - "googleDork": false, - "registration": true, - "editUrl": false, - "api": true, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "Cymon Open Threat Intelligence", - "type": "url", - "url": "https://cymon.io/", - "description": "Largest open tracker of malware, phishing, botnets containing 6M+ malicious IPs.", - "status": "live", - "pricing": "freemium", - "bestFor": "IP threat tracking", - "input": "IP address or threat indicator", - "output": "Malware and threat reports", - "opsec": "passive", - "opsecNote": "Passive threat database queries", - "localInstall": false, - "googleDork": false, - "registration": true, - "editUrl": false, - "api": true, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "mlsecproject / combine", - "type": "url", - "url": "https://github.com/mlsecproject/combine", - "description": "Tool for gathering and normalizing threat intelligence feeds from public sources.", - "status": "live", - "pricing": "free", - "bestFor": "Threat feed aggregation", - "input": "Multiple threat intelligence feeds", - "output": "Normalized IOC data in CSV or CRITs format", - "opsec": "passive", - "opsecNote": "Local processing of public feeds", - "localInstall": true, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": false, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "hostintel - keithjjones Github", - "type": "url", - "url": "https://github.com/keithjjones/hostintel", - "description": "Modular Python application to collect host and malicious IP intelligence.", - "status": "live", - "pricing": "free", - "bestFor": "Host intelligence gathering", - "input": "IP, FQDN, or domain name", - "output": "Intelligence data in CSV format", - "opsec": "passive", - "opsecNote": "Local tool for passive host analysis", - "localInstall": true, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": false, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "massive-octo-spice - csirtgadgets Github", - "type": "url", - "url": "https://github.com/csirtgadgets/massive-octo-spice", - "description": "CSIRT threat intelligence platform (deprecated - use bearded-avenger v3 instead).", - "status": "degraded", - "pricing": "free", - "bestFor": "Legacy CSIRT intelligence platform", - "input": "Threat intelligence feeds", - "output": "Aggregated threat data", - "opsec": "passive", - "opsecNote": "Local platform for threat aggregation", - "localInstall": true, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": false, - "invitationOnly": false, - "deprecated": true - }, - { - "name": "Scam Database", - "type": "url", - "url": "https://www.scamdb.net/", - "description": "User-contributed database of scam reports searchable by phone, email, and website.", - "status": "live", - "pricing": "free", - "bestFor": "Scam and fraud reporting", - "input": "Phone, email, or website", - "output": "Unverified scam reports and details", - "opsec": "passive", - "opsecNote": "Passive lookup of community reports", - "localInstall": false, - "googleDork": false, - "registration": true, - "editUrl": false, - "api": false, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "Bot Scout", - "type": "url", - "url": "https://botscout.com/", - "description": "Service tracking bot signatures (names, IPs, emails) to prevent automated spam and abuse.", - "status": "live", - "pricing": "freemium", - "bestFor": "Bot and spam detection", - "input": "IP, email, or username", - "output": "Bot activity and spam records", - "opsec": "passive", - "opsecNote": "Passive honeypot-based detection", - "localInstall": false, - "googleDork": false, - "registration": true, - "editUrl": false, - "api": true, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "APTnotes", - "type": "url", - "url": "https://github.com/aptnotes/data", - "description": "Repository of public documents, whitepapers, and articles about APT campaigns.", - "status": "live", - "pricing": "free", - "bestFor": "APT research and threat analysis", - "input": "Search APT campaign documents", - "output": "Threat reports and analysis", - "opsec": "passive", - "opsecNote": "Passive access to public threat research", - "localInstall": false, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": false, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "HoneyDB", - "type": "url", - "url": "https://honeydb.io/", - "description": "Honeypot network providing real-time IoT and server threat intelligence via REST API.", - "status": "live", - "pricing": "freemium", - "bestFor": "IoT honeypot intelligence", - "input": "IP address or attack queries", - "output": "Honeypot interaction logs and threat data", - "opsec": "passive", - "opsecNote": "Passive honeypot-based intelligence", - "localInstall": false, - "googleDork": false, - "registration": true, - "editUrl": false, - "api": true, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "Pulsedive", - "type": "url", - "url": "https://pulsedive.com/", - "description": "Free threat intelligence platform for enriching IPs, URLs, domains, and IOCs from OSINT feeds.", - "status": "live", - "pricing": "freemium", - "bestFor": "IOC enrichment and risk scoring", - "input": "IP, URL, domain, or IOC", - "output": "Enriched threat intelligence and risk factors", - "opsec": "passive", - "opsecNote": "Passive querying of enrichment database", - "localInstall": false, - "googleDork": false, - "registration": true, - "editUrl": false, - "api": true, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "Mr.Looquer IOC Feed - 1st Dual Stack Threat Feed", - "type": "url", - "url": "https://iocfeed.mrlooquer.com/", - "description": "Threat intelligence feed providing IOC data with IPv4/IPv6 dual stack support.", - "status": "live", - "pricing": "free", - "bestFor": "IOC threat feed access", - "input": "Feed subscription", - "output": "IOC threat intelligence feed", - "opsec": "passive", - "opsecNote": "Passive threat feed consumption", - "localInstall": false, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": false, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "REScure Cyber Threat Intelligence Project", - "type": "url", - "url": "https://rescure.me/", - "description": "Community-driven cyber threat intelligence project providing IOC feeds and research.", - "status": "live", - "pricing": "free", - "bestFor": "Threat intelligence feeds", - "input": "IOC feed subscription", - "output": "IOC threat intelligence", - "opsec": "passive", - "opsecNote": "Passive threat feed access", - "localInstall": false, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": false, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "Attack Surface / Security Testing", - "type": "folder", + "name": "Threat Feeds & Platforms", "children": [ { - "name": "ImmuniWeb", + "name": "IBM X-Force Exchange", "type": "url", - "url": "https://www.immuniweb.com/", - "description": "AI-powered application security platform for web penetration testing and vulnerability scanning.", + "url": "https://exchange.xforce.ibmcloud.com/", + "description": "Collaborative threat intelligence platform with malware, vulnerability, and campaign data.", "status": "live", "pricing": "freemium", - "bestFor": "Web security testing and scanning", - "input": "Web application or target URL", - "output": "Vulnerability reports and risk assessment", - "opsec": "active", - "opsecNote": "Performs actual penetration testing and scanning - generates server logs", + "bestFor": "Malware and threat intelligence", + "input": "IOC, domain, or malware sample", + "output": "Threat analysis and intelligence reports", + "opsec": "passive", + "opsecNote": "Passive querying of threat database", "localInstall": false, "googleDork": false, "registration": true, @@ -20615,6 +20212,416 @@ "api": true, "invitationOnly": false, "deprecated": false + }, + { + "name": "Malware Information Sharing Platform", + "type": "url", + "url": "https://www.misp-project.org/", + "description": "Open-source platform for collecting, storing, and sharing cyber threat indicators and malware data.", + "status": "live", + "pricing": "free", + "bestFor": "Threat intelligence sharing", + "input": "Threat indicators and malware samples", + "output": "Structured threat intelligence and correlations", + "opsec": "passive", + "opsecNote": "Local platform for passive sharing", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "Malware Patrol", + "type": "url", + "url": "https://www.malwarepatrol.net/", + "description": "Threat intelligence feed service providing malware samples, URLs, domains, and IOC data.", + "status": "live", + "pricing": "freemium", + "bestFor": "Malware IOC and feed intelligence", + "input": "IOC queries or feed subscriptions", + "output": "Malware hashes, URLs, and threat intel", + "opsec": "passive", + "opsecNote": "Passive consumption of threat feeds", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "AlienVault OTX", + "type": "url", + "url": "https://otx.alienvault.com/", + "description": "Crowd-sourced threat intelligence platform with 180K+ participants sharing 19M+ daily threats.", + "status": "live", + "pricing": "free", + "bestFor": "Community threat intelligence", + "input": "IOC, domain, IP, or search query", + "output": "Community threat pulses and analysis", + "opsec": "passive", + "opsecNote": "Passive community threat data sharing", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "FireHOL IP Lists ", + "type": "url", + "url": "https://iplists.firehol.org/", + "description": "Collection of firewall-friendly IP blacklists for blocking malicious and spam sources.", + "status": "live", + "pricing": "free", + "bestFor": "IP reputation and blocking", + "input": "IP address or list subscription", + "output": "Blacklist membership status", + "opsec": "passive", + "opsecNote": "Passive lookup of public reputation lists", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "Maltiverse", + "type": "url", + "url": "https://maltiverse.com/", + "description": "Threat intelligence platform aggregating 100+ sources with real-time IOC scoring.", + "status": "live", + "pricing": "freemium", + "bestFor": "IOC aggregation and scoring", + "input": "IOC or threat indicator", + "output": "Threat scores and context", + "opsec": "passive", + "opsecNote": "Passive aggregation of threat data", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "Malpedia", + "type": "url", + "url": "https://malpedia.caad.fkie.fraunhofer.de/", + "description": "Free collaborative malware database from Fraunhofer FKIE with 600+ malware families.", + "status": "live", + "pricing": "freemium", + "bestFor": "Malware family identification", + "input": "Malware sample or family name", + "output": "Malware family analysis and YARA rules", + "opsec": "passive", + "opsecNote": "Passive malware research database", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": true, + "deprecated": false + }, + { + "name": "Project Honey Pot", + "type": "url", + "url": "https://www.projecthoneypot.org/", + "description": "Distributed honeypot project tracking email harvesters, spam servers, and malicious IPs.", + "status": "live", + "pricing": "free", + "bestFor": "Spam and harvester tracking", + "input": "IP address or email domain", + "output": "Harvester and spam activity records", + "opsec": "passive", + "opsecNote": "Passive honeypot intelligence", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "Cymon Open Threat Intelligence", + "type": "url", + "url": "https://cymon.io/", + "description": "Largest open tracker of malware, phishing, botnets containing 6M+ malicious IPs.", + "status": "live", + "pricing": "freemium", + "bestFor": "IP threat tracking", + "input": "IP address or threat indicator", + "output": "Malware and threat reports", + "opsec": "passive", + "opsecNote": "Passive threat database queries", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "mlsecproject / combine", + "type": "url", + "url": "https://github.com/mlsecproject/combine", + "description": "Tool for gathering and normalizing threat intelligence feeds from public sources.", + "status": "live", + "pricing": "free", + "bestFor": "Threat feed aggregation", + "input": "Multiple threat intelligence feeds", + "output": "Normalized IOC data in CSV or CRITs format", + "opsec": "passive", + "opsecNote": "Local processing of public feeds", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "hostintel - keithjjones Github", + "type": "url", + "url": "https://github.com/keithjjones/hostintel", + "description": "Modular Python application to collect host and malicious IP intelligence.", + "status": "live", + "pricing": "free", + "bestFor": "Host intelligence gathering", + "input": "IP, FQDN, or domain name", + "output": "Intelligence data in CSV format", + "opsec": "passive", + "opsecNote": "Local tool for passive host analysis", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "massive-octo-spice - csirtgadgets Github", + "type": "url", + "url": "https://github.com/csirtgadgets/massive-octo-spice", + "description": "CSIRT threat intelligence platform (deprecated - use bearded-avenger v3 instead).", + "status": "degraded", + "pricing": "free", + "bestFor": "Legacy CSIRT intelligence platform", + "input": "Threat intelligence feeds", + "output": "Aggregated threat data", + "opsec": "passive", + "opsecNote": "Local platform for threat aggregation", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true + }, + { + "name": "Scam Database", + "type": "url", + "url": "https://www.scamdb.net/", + "description": "User-contributed database of scam reports searchable by phone, email, and website.", + "status": "live", + "pricing": "free", + "bestFor": "Scam and fraud reporting", + "input": "Phone, email, or website", + "output": "Unverified scam reports and details", + "opsec": "passive", + "opsecNote": "Passive lookup of community reports", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "Bot Scout", + "type": "url", + "url": "https://botscout.com/", + "description": "Service tracking bot signatures (names, IPs, emails) to prevent automated spam and abuse.", + "status": "live", + "pricing": "freemium", + "bestFor": "Bot and spam detection", + "input": "IP, email, or username", + "output": "Bot activity and spam records", + "opsec": "passive", + "opsecNote": "Passive honeypot-based detection", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "APTnotes", + "type": "url", + "url": "https://github.com/aptnotes/data", + "description": "Repository of public documents, whitepapers, and articles about APT campaigns.", + "status": "live", + "pricing": "free", + "bestFor": "APT research and threat analysis", + "input": "Search APT campaign documents", + "output": "Threat reports and analysis", + "opsec": "passive", + "opsecNote": "Passive access to public threat research", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "HoneyDB", + "type": "url", + "url": "https://honeydb.io/", + "description": "Honeypot network providing real-time IoT and server threat intelligence via REST API.", + "status": "live", + "pricing": "freemium", + "bestFor": "IoT honeypot intelligence", + "input": "IP address or attack queries", + "output": "Honeypot interaction logs and threat data", + "opsec": "passive", + "opsecNote": "Passive honeypot-based intelligence", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "Pulsedive", + "type": "url", + "url": "https://pulsedive.com/", + "description": "Free threat intelligence platform for enriching IPs, URLs, domains, and IOCs from OSINT feeds.", + "status": "live", + "pricing": "freemium", + "bestFor": "IOC enrichment and risk scoring", + "input": "IP, URL, domain, or IOC", + "output": "Enriched threat intelligence and risk factors", + "opsec": "passive", + "opsecNote": "Passive querying of enrichment database", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "Mr.Looquer IOC Feed - 1st Dual Stack Threat Feed", + "type": "url", + "url": "https://iocfeed.mrlooquer.com/", + "description": "Threat intelligence feed providing IOC data with IPv4/IPv6 dual stack support.", + "status": "live", + "pricing": "free", + "bestFor": "IOC threat feed access", + "input": "Feed subscription", + "output": "IOC threat intelligence feed", + "opsec": "passive", + "opsecNote": "Passive threat feed consumption", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "REScure Cyber Threat Intelligence Project", + "type": "url", + "url": "https://rescure.me/", + "description": "Community-driven cyber threat intelligence project providing IOC feeds and research.", + "status": "live", + "pricing": "free", + "bestFor": "Threat intelligence feeds", + "input": "IOC feed subscription", + "output": "IOC threat intelligence", + "opsec": "passive", + "opsecNote": "Passive threat feed access", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + } + ] + }, + { + "name": "TTPs", + "children": [ + { + "name": "Malware Exploit TTP Database", + "type": "url", + "url": "https://www.pwnmalw.re/", + "description": "Malware exploit database documenting security vulnerabilities in malware families (offline).", + "status": "down", + "pricing": "free", + "bestFor": "Malware exploit research", + "input": "Malware name or exploit query", + "output": "Exploit documentation and vulnerability details", + "opsec": "passive", + "opsecNote": "Passive lookup when functional", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true + }, + { + "name": "Mitre TTPs", + "type": "url", + "url": "https://attack.mitre.org/", + "description": "MITRE ATT&CK framework: globally-accessible knowledge base of adversary tactics and techniques.", + "status": "live", + "pricing": "free", + "bestFor": "Threat modeling and TTP analysis", + "input": "Search for tactics, techniques, or threat groups", + "output": "Technique descriptions and mitigation strategies", + "opsec": "passive", + "opsecNote": "Passive research of public threat intelligence", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "MITRE ATT&CK", + "type": "url", + "url": "https://attack.mitre.org/" } ] } @@ -20892,7 +20899,7 @@ "url": "https://themanyhats.club/centralised-place-for-privacy-resources/" }, { - "name": "The Hitchhiker’s Guide to Online Anonymity", + "name": "The Hitchhiker\u2019s Guide to Online Anonymity", "type": "url", "url": "https://anonymousplanet.org/guide/" }, @@ -21173,4 +21180,4 @@ ] } ] -} +} \ No newline at end of file