ThreatFoxthreatfox.abuse.ch
abuse.ch database of malware IOCs (C2 IPs, domains, URLs, hashes) tagged by malware family, free to search and export.
ip / asndomainurlfile / docdetails
tools / alienvault-otx
AlienVault OTX
LevelBlue (formerly AT&T) Open Threat Exchange. Community threat pulses, passive DNS and indicator lookups for IPs, domains, hashes and URLs.
freeacct optionalapiweb
used in playbooks
similar tools
URLhausurlhaus.abuse.ch
abuse.ch database of URLs used for malware distribution, searchable by URL, host, hash or tag, with downloadable feeds.
urldomainip / asnfile / docdetails
VirusTotalvirustotal.com
Scans files, URLs, domains and IPs against 70+ engines. The relations graph shows passive DNS, communicating files, subdomains and historical WHOIS.
file / docurldomainip / asndetails
Pulsedivepulsedive.com
Free threat intel platform that enriches IPs, domains and URLs with risk scores, linked threats, feeds and WHOIS/DNS context.
ip / asndomainurldetails
urlscan.iourlscan.io
Sandbox that loads a URL and records the requests, IPs, domains, screenshots and DOM. Its search across millions of past scans is a pivot goldmine.
urldomainip / asndetails
httpxgithub.com
HTTP probing toolkit that checks which hosts are live and grabs titles, status codes, tech stack, TLS details and favicon hashes in bulk.
domainip / asnurldetails