#threat-intelligence (30 Repositories)
Ranked open-source repositories tagged with #threat-intelligence, scored by pull request acceptance likelihood and maintainer engagement velocity.
56.6%
132.2h
30 repositories tagged #threat-intelligence
kaifcodec/user-scanner
🕵️♂️ (2-in-1) Email & Username OSINT suite featuring native MCP support for deep data extraction just from a single Email/Username. Analyzes 1080+ actively maintained scan vectors (200+ email / 880+ username) for security research, investigations, and digital footprinting.
OpenCTI-Platform/opencti
Open Cyber Threat Intelligence Platform
OpenCTI-Platform/connectors
OpenCTI Connectors
mandiant/capa
The FLARE team's open-source tool to identify capabilities in executable files.
MISP/misp-galaxy
Clusters and elements to attach to MISP events or attributes (like threat actors)
phishdestroy/destroylist
Real-time phishing & scam domain blocklist - 205k+ curated threats, 1M+ community, free API, multiple formats
w0h1v/mcp-virustotal
MCP server for VirusTotal API — analyze URLs, files, IPs, and domains with comprehensive security reports, relationship analysis, and pagination support.
fhightower/ioc-finder
Simple, effective, and modular package for parsing observables (indicators of compromise (IOCs), network data, and other, security related information) from text. It uses grammars rather than regexes which makes it more readable, maintainable, and hackable. Explore our interactive documentation here: https://hightower.space/ioc-finder/
MISP/misp-modules
Modules for expansion services, enrichment, import and export in MISP and other tools.
abhizaik/urlvet
Open-source phishing detection engine with explainable verdict. Self-hostable alternative to VirusTotal, CheckPhish, URLScan.io
7onez/cti-expert
CTI Expert — Cyber Threat Intelligence & OSINT analysis skill for Claude Code. 67+ commands, 35 techniques, no API keys required.
andreicscs/HoneyWire
HoneyWire: The Open-Source, Unlimited Deception Platform. Turn any Linux machine into an enterprise-grade canary in 60 seconds.
lolc2/lolc2.github.io
lolC2 is a collection of C2 frameworks that leverage legitimate services to evade detection
Bert-JanP/Open-Source-Threat-Intel-Feeds
This repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. Contains multiple types such as IP, URL, CVE and Hash.
thalesgroup-cert/Watcher
Watcher - Open Source AI-powered Cyber Threat Intelligence & Hunting Platform. Developed with Django & React JS.
pedramamini/ThreatIngestor
Extract and aggregate threat intelligence.
wolffcatskyy/crowdsec-blocklist-import
10-20x more blocks for your CrowdSec bouncers — 120k+ IPs from 32 free threat feeds
osintbrazuca/osint-brazuca
Repositório criado com intuito de reunir informações, fontes(websites/portais) e tricks de OSINT dentro do contexto Brasil.
gendigitalinc/ioc
Threat Intel IoCs + bits and pieces of dark matter. Published by Gen Threat Labs.
MISP/misp-warninglists
Warning lists to inform users of MISP about potential false-positives or other information in indicators
OTT-Cybersecurity-LLC/lyrie-ai
Lyrie.ai — The world's first autonomous AI cybersecurity agent. Built by OTT Cybersecurity LLC.
RansomLook/RansomLook
Yet another Ransomware gang tracker
KatrielMoses/voidaccess
Self-hosted dark web OSINT platform. Automated threat intelligence from query to graph in 13 steps. Free alternative to Recorded Future, DarkOwl, and Flare.
vmkspv/lenspect
A lightweight security threat scanner intended to make malware detection more accessible and efficient.
atenreiro/opensquat
openSquat is an open-source tool that detects look-alike domains impersonating your brand, by scanning newly registered domains daily.
phishdestroy/ScamIntelLogs
Open-source intelligence archive of crypto scam operations — internal chats, admin panels, victim records, and infrastructure data for research and investigation
A3sal0n/CyberThreatHunting
A collection of resources for Threat Hunters
dev-lu/osint_toolkit
Open source platform for cyber security analysts with many features for threat intelligence and detection engineering.
urlvet/urlvet
Open-source phishing detection engine with explainable verdict. Self-hostable alternative to VirusTotal, CheckPhish, URLScan.io
prodaft/cradle
CRADLE is a collaborative platform for Cyber Threat Intelligence analysts. It streamlines threat investigations with integrated note-taking, automated data linking, interactive visualizations, and robust access control. Enhance your CTI workflow from analysis to reporting—all in one secure space.