duggytuxy/data-shield_ipv4_blocklistCurated IPv4 blocklist of malicious addresses, refreshed every 6 hours for firewall and WAF ingestion, with split lists and CTI-ready formats for…
opencti-platform/connectorsCollection of OpenCTI connectors that ingest and synchronize threat intelligence, IOCs, and CTI data from external sources like MISP and MITRE ATT&CK…
drb-ra/c2intelfeedsAutomatically generated C2 threat intelligence feeds of IPs, domains, URL paths, and implant configuration metadata, derived from internet scanning…
cowrie/cowrieCowrie SSH/Telnet Honeypot https://docs.cowrie.org/
fazmin/cve-intelLocal security intelligence for CVE triage - 40 data sources and 41 tools, risk scores and an MCP server for AI agents, all in native Rust. Private…
outflanknl/redelkRed Team's SIEM - tool for Red Teams used for tracking and alarming about Blue Team activities as well as better usability in long term operations.
phpatch/weblogcheckerFree access-log compromise analyzer: webshell interactions, exploitation patterns and brute-force bursts in your Apache/nginx logs - severity,…
honeylabshq/spip-goSpip network sensor written in Go
abdaullahag/threatlensPython CLI tool for rapid IOC analysis (IPs, Domains, CVEs) using 6 free Threat Intel APIs. Outputs: Color-coded Excel, JSON, CSV. Uses: VT, Shodan,…
0x4d31/honeypot-dataPublic honeypot datasets and observation reports with HTTP/TLS fingerprint data (JA3/JA4), pseudonymized source IPs, and exploitation attempt…
xephora/threat-remediation-scriptsThis repository contains a list of new remediation scripts.
thehive-project/cortexCortex: a Powerful Observable Analysis and Active Response Engine
gamelinux/passivednsA network sniffer that logs all DNS server replies for use in a passive DNS setup
rastrea2r/rastrea2rCollecting & Hunting for IOCs with gusto and style
0xajstrike/opcuatrapHigh-interaction OPC UA honeypot for ICS/SCADA — multi-profile (oil & gas, water, power grid), live process simulation, per-session threat scoring,…
perplexityai/bumblebeeRead-only developer endpoint scanner for on-disk package, extension, and developer-tool metadata, built to check exposure to known software…
niffyhunt/wraithwall-toolkitDeception-engineering tools pulled from a production platform that takes live attacker traffic, supply-chain canary tokens, honeypot logs → MITRE…
watchtowrlabs/citrix-netscaler-cve-2026-88771-iocsIndicators of Compromise and hunting guidance for CVE-2026-88771, an unauthenticated command injection in Citrix NetScaler ADC and Gateway, covering…
