AlienVault OTXotx.alienvault.com
LevelBlue (formerly AT&T) Open Threat Exchange. Community threat pulses, passive DNS and indicator lookups for IPs, domains, hashes and URLs.
ip / asndomainfile / docurldetails
tools / virustotal
VirusTotal
Scans files, URLs, domains and IPs against 70+ engines. The relations graph shows passive DNS, communicating files, subdomains and historical WHOIS.
freemiumacct optionalapiweb
field note
Never upload sensitive or case files. Uploads are shared with paying customers and the file author may be watching. Search by hash instead.
used in playbooks
similar tools
ThreatFoxthreatfox.abuse.ch
abuse.ch database of malware IOCs (C2 IPs, domains, URLs, hashes) tagged by malware family, free to search and export.
ip / asndomainurlfile / docdetails
URLhausurlhaus.abuse.ch
abuse.ch database of URLs used for malware distribution, searchable by URL, host, hash or tag, with downloadable feeds.
urldomainip / asnfile / docdetails
urlscan.iourlscan.io
Sandbox that loads a URL and records the requests, IPs, domains, screenshots and DOM. Its search across millions of past scans is a pivot goldmine.
urldomainip / asndetails
httpxgithub.com
HTTP probing toolkit that checks which hosts are live and grabs titles, status codes, tech stack, TLS details and favicon hashes in bulk.
domainip / asnurldetails
Pulsedivepulsedive.com
Free threat intel platform that enriches IPs, domains and URLs with risk scores, linked threats, feeds and WHOIS/DNS context.
ip / asndomainurldetails