gnomeman/badbanana-threat-observatoryThreat intel observatory aggregating CISA KEV, ThreatFox, URLhaus, and MalwareBazaar feeds with search, change tracking, and STIX/CSV/JSONL export.
honeylabshq/spip-goLightweight low-interaction network honeypot sensor that captures TCP payloads, performs passive TLS/HTTP/SSH fingerprinting, and outputs structured…
expel-io/expel-intelCurated repository of IOCs and threat intelligence from the Expel Intel Team, providing actionable indicators for detection and response workflows.
ctrlaltint3l/intelligenceCentralized repository for malware samples, threat intelligence, IOCs, and security tooling logs to support threat research and incident response…
backbay-labs/thrunt-godThreat hunting command system for agentic IDEs
cve-search/cve-searchLocal CVE/CPE vulnerability database with search, ranking, web interface, and API for offline vulnerability analysis and management.
thehive-project/cortexAutomated observable analysis engine for threat intelligence, digital forensics, and incident response, integrating with diverse analyzers via a…
limo57640-crypto/wp-user-registration-vuln-checkerRead-only WordPress User Registration CVE-2026-1492 checker for hidden admins, plugin version, uploads PHP, cron, and compromise IOCs.
grayxploit/cve-2026-0257Automated vulnerability scanner for CVE-2026-0257 (PAN-OS GlobalProtect Authentication Bypass) with TLS certificate enumeration, authentication…
destiny-creates/goxlr-malware-familyReverse engineering repository for malware samples from goxlr.net and related domains, focusing on stealer variants, C2 infrastructure analysis, and…
pedramamini/threatingestorAutomated threat intelligence aggregation tool that extracts and normalizes indicators from multiple sources (OSINT feeds, malware reports) into a…
emergingthreats/threatresearchProofpoint - Emerging Threats - Threat Research tools + publicly shared intel and documentation
certtools/intelmqMessage-queue-based threat intelligence feed collector and processor for CSIRTs. Automates ingestion, normalization, and sharing of security…
montysecurity/c2-trackerLive Feed of C2 servers, tools, and botnets
inquest/threatkbKnowledge base workflow management for YARA rules and C2 artifacts (IP, DNS, SSL) (ALPHA STATE AT THE MOMENT)
rollwagen/abusechCommand-line client for abuse.ch threat intelligence APIs, enabling query and retrieval of Indicators of Compromise (IOCs) for threat hunting and…
abhinavbom/threat-intelligence-hunterCLI tool to search, aggregate, and store IOCs from multiple open security feeds and APIs, enabling local threat intelligence database creation and…
jonathanstross/cve-2025-31324Python scanner for detecting CVE-2025-31324 in SAP Visual Composer, with custom IOC-based webshell detection and multi-target CSV input.
