| Subdomains |
Amass |
amass enum -d target.com -o subs.txt |
| Certificates |
CRT.sh |
curl https://crt.sh/?q=%25.target.com&output=json |
| Historical DNS |
SecurityTrails |
Free API 50/month |
| Neighbor IPs |
BGP.he |
CIDR |
| Reputation |
VirusTotal |
vt ip_info <ip> |
| Quick scan |
Nmap-online |
no VPN |
| Subdomains |
Subdomain Center |
https://www.subdomain.center |
| Subdomains |
SubdomainRadar |
https://www.subdomainradar.io |
| Historical DNS |
DNS History |
http://dnshistory.org |
| Reputation |
Talos |
https://www.talosintelligence.com/ |
| Scan |
Binary Defense |
https://www.binarydefense.com/banlist.txt |
| BGP Ranking |
CIRCL BGP |
https://bgpranking.circl.lu |
| Botnet Tracker |
MalwareTech |
https://intel.malwaretech.com/ |
| BOTVRIJ.EU |
BOTVRIJ |
http://www.botvrij.eu/ |
| C&C Tracker |
Bambenek |
http://osint.bambenekconsulting.com/feeds/c2-ipmasterlist.txt |
| CertStream |
CertStream |
https://certstream.calidog.io/ |
| CCSS Forum |
CCSS Forum |
http://www.ccssforum.org/malware-certificates.php |
| CI Army List |
CINS Score |
http://cinsscore.com/#list |
| Cisco Umbrella |
Cisco Umbrella |
http://s3-us-west-1.amazonaws.com/umbrella-static/index.html |
| Cloudmersive |
Cloudmersive |
https://cloudmersive.com/virus-api |
| Critical Stack |
Critical Stack |
https://intelstack.com/ |
| CrowdSec |
CrowdSec |
https://app.crowdsec.net/ |
| Cyber Cure |
Cyber Cure |
https://www.cybercure.ai/ |
| DataPlane |
DataPlane |
https://dataplane.org/ |
| Focsec |
Focsec |
https://focsec.com |
| Disposable Domains |
Disposable Domains |
https://github.com/martenson/disposable-email-domains |
| Emerging Threats |
Emerging Threats |
http://rules.emergingthreats.net/fwrules/ |
| ExoneraTor |
ExoneraTor |
https://exonerator.torproject.org/ |
| Exploitalert |
Exploitalert |
http://www.exploitalert.com/ |
| FastIntercept |
FastIntercept |
https://intercept.sh/threatlists/ |
| Feodo Tracker |
Feodo Tracker |
https://feodotracker.abuse.ch/ |
| FireHOL |
FireHOL |
http://iplists.firehol.org/ |
| FraudGuard |
FraudGuard |
https://fraudguard.io/ |
| Grey Noise |
Grey Noise |
http://greynoise.io/ |
| HoneyDB |
HoneyDB |
https://riskdiscovery.com/honeydb/ |
| Icewater |
Icewater |
https://github.com/SupportIntelligence/Icewater |
| InQuest Labs |
InQuest Labs |
https://labs.inquest.net |
| I-Blocklist |
I-Blocklist |
https://www.iblocklist.com/lists |
| IPsum |
IPsum |
https://raw.githubusercontent.com/stamparm/ipsum/master/ipsum.txt |
| James Brine |
James Brine |
https://jamesbrine.com.au |
| Kaspersky Feeds |
Kaspersky |
https://support.kaspersky.com/datafeeds |
| Malpedia |
Malpedia |
https://malpedia.caad.fkie.fraunhofer.de/ |
| MalShare |
MalShare |
http://www.malshare.com/ |
| Maltiverse |
Maltiverse |
https://www.maltiverse.com/ |
| MalwareBazaar |
MalwareBazaar |
https://bazaar.abuse.ch/ |
| Malware Domain List |
Malware Domain List |
https://www.malwarepatrol.net/ |
| MetaDefender |
MetaDefender |
https://www.opswat.com/developers/threat-intelligence-feed |
| Netlab OpenData |
Netlab |
https://data.netlab.360.com/ |
| NoThink! |
NoThink! |
http://www.nothink.org |
| Obstracts |
Obstracts |
https://www.obstracts.com/ |
| OpenPhish |
OpenPhish |
https://openphish.com/phishing_feeds.html |
| 0xSI_f33d |
0xSI_f33d |
https://feed.seguranca-informatica.pt/index.php |
| PhishTank |
PhishTank |
https://www.phishtank.com/developer_info.php |
| PickupSTIX |
PickupSTIX |
https://www.celerium.com/pickupstix |
| RST Cloud |
RST Cloud |
https://rstcloud.net/ |
| SecurityScorecard |
SecurityScorecard |
https://github.com/securityscorecard/SSC-Threat-Intel-IoCs |
| Stixify |
Stixify |
https://www.stixify.com/ |
| signature-base |
signature-base |
https://github.com/Neo23x0/signature-base |
| Spamhaus |
Spamhaus |
https://www.spamhaus.org/ |
| Sophos Intelix |
Sophos |
https://www.sophos.com/intelix |
| Spur |
Spur |
https://spur.us |
| SSL Blacklist |
SSL Blacklist |
https://sslbl.abuse.ch/ |
| Statvoo |
Statvoo |
https://statvoo.com/dl/top-1million-sites.csv.zip |
| Strongarm |
Strongarm |
https://strongarm.io |
| SIEM Rules |
SIEM Rules |
https://www.siemrules.com |
| Talos |
Talos |
https://www.talosintelligence.com/ |
| threatfeeds.io |
threatfeeds.io |
https://threatfeeds.io |
| threatfox |
threatfox |
https://threatfox.abuse.ch/ |
| Technical Blogs (Dataminr) |
Technical Blogs |
https://www.dataminr.com/blog/ |
| ThreatMiner |
ThreatMiner |
https://www.threatminer.org/ |
| ThreatExchange |
ThreatExchange |
https://developers.facebook.com/docs/threat-exchange/ |
| TypeDB CTI |
TypeDB CTI |
https://github.com/typedb-osi/typedb-cti |
| XFE |
XFE |
https://exchange.xforce.ibmcloud.com/ |
| Yeti |
Yeti |
https://yeti-platform.github.io/ |
| 1st Dual Stack |
1st Dual Stack |
https://IOCFeed.mrlooquer.com/ |
| Yara-Rules |
Yara-Rules |
https://github.com/Yara-Rules/rules |
| VirusShare |
VirusShare |
https://virusshare.com/ |
| CIRCL PDNS |
CIRCL PDNS |
https://www.circl.lu/services/passive-dns |
| InTheWild |
InTheWild |
https://inthewild.io |
| 360 Quake |
360 Quake |
https://quake.360.net |
| Cloudflare Radar |
Cloudflare Radar |
https://radar.cloudflare.com/traffic |
| Validin |
Validin |
https://app.validin.com |
| OSV |
OSV |
https://osv.dev |
| Coalition ESS |
Coalition ESS |
https://ess.coalitioninc.com |
| WHOIS & Domain History |
WhoisFreaks |
https://whoisfreaks.com |
| IP Geolocation & Threat Intel |
ipgeolocation.io |
https://ipgeolocation.io |