Threat Feeds & Aggregators

fastfire/deepdarkcti

Collection of Cyber Threat Intelligence sources from the deep and dark web

opencti-platform/opencti

Open Cyber Threat Intelligence Platform

misp/misp

MISP (core software) - Open Source Threat Intelligence and Sharing Platform

stamparm/maltrail

Real-time malicious traffic detection system using public blacklists, static malware trails, and heuristic analysis to identify threats across DNS,…

crowdsecurity/crowdsec

Open-source IDS/IPS and WAF engine that analyzes logs and HTTP requests to detect and block malicious IPs, leveraging a crowdsourced community…

neo23x0/signature-base

YARA signature and IOC database for my scanners and tools

intelowlproject/intelowl

Scalable threat intelligence platform that enriches observables and files using 200+ analyzers, with built-in GUI, REST API, and automated workflows…

yeti-platform/yeti

Your Everyday Threat Intelligence

bushidouk/ransomware-tool-matrix

A resource containing all the tools each ransomware gangs uses

cyb3rward0g/helk

The Hunting ELK

phishdestroy/destroylist

Real-time phishing & scam domain blocklist - 208k+ curated threats, 1M+ community, free API, multiple formats

mthcht/awesome-lists

Curated repository of threat intelligence feeds, IoC lists, YARA rules, and DFIR tool references for SOC/CERT/CTI detection and incident response.

paloaltonetworks/unit42-timely-threat-intel

A collection of files with indicators supporting social media posts from Palo Alto Network's Unit 42 team to disseminate timely threat intelligence.

certtools/intelmq

IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.

ninoseki/mihari

A query aggregator for OSINT based threat hunting

ransomlook/ransomlook

Automated ransomware and leak-site OSINT tracker scraping dark-web markets, monitoring victim posts, enriching actor/crypto data, and sending…

pirxthepilot/wtfis

Passive hostname, domain and IP lookup tool for non-robots