ThreatFox

LevelBlue (formerly AT&T) Open Threat Exchange. Community threat pulses, passive DNS and indicator lookups for IPs, domains, hashes and URLs.

abuse.ch database of URLs used for malware distribution, searchable by URL, host, hash or tag, with downloadable feeds.

Scans files, URLs, domains and IPs against 70+ engines. The relations graph shows passive DNS, communicating files, subdomains and historical WHOIS.

Free threat intel platform that enriches IPs, domains and URLs with risk scores, linked threats, feeds and WHOIS/DNS context.

Sandbox that loads a URL and records the requests, IPs, domains, screenshots and DOM. Its search across millions of past scans is a pivot goldmine.

HTTP probing toolkit that checks which hosts are live and grabs titles, status codes, tech stack, TLS details and favicon hashes in bulk.