Pulsedive

LevelBlue (formerly AT&T) Open Threat Exchange. Community threat pulses, passive DNS and indicator lookups for IPs, domains, hashes and URLs.

abuse.ch database of malware IOCs (C2 IPs, domains, URLs, hashes) tagged by malware family, free to search and export.

abuse.ch database of URLs used for malware distribution, searchable by URL, host, hash or tag, with downloadable feeds.

Threat-focused internet asset search engine with IP and domain risk scoring, exposed services, vulnerabilities and screenshot reports.

Sandbox that loads a URL and records the requests, IPs, domains, screenshots and DOM. Its search across millions of past scans is a pivot goldmine.

Scans files, URLs, domains and IPs against 70+ engines. The relations graph shows passive DNS, communicating files, subdomains and historical WHOIS.