ethan-andrews/threatintel-aggregatorSelf-hosted threat intelligence platform — feed aggregation, AI triage, MITRE ATT&CK coverage, and Sentinel-integrated detection engineering. Runs…
duggytuxy/data-shield_ipv4_blocklistCurated IPv4 blocklist of malicious addresses, refreshed every 6 hours for firewall and WAF ingestion, with split lists and CTI-ready formats for…
badchars/darknet-mcp-server66-tool MCP server for dark web intelligence — breach data, ransomware tracking, Tor .onion access, malware analysis, blockchain intel, exploit…
bert-janp/open-source-threat-intel-feedsThis repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. Contains multiple types such…
gnomeman/badbanana-threat-observatoryThreat intel observatory aggregating CISA KEV, ThreatFox, URLhaus, and MalwareBazaar feeds with search, change tracking, and STIX/CSV/JSONL export.
hslatman/awesome-threat-intelligenceCurated directory of threat intelligence sources, feeds, frameworks, tools, and research for SOC/CTI teams—covering IOCs, STIX/TAXII formats, and…
misp/misp-galaxyClusters and elements to attach to MISP events or attributes (like threat actors)
misp/misp-objectsCurated JSON object templates that define MISP attributes and relationship types for structured threat intelligence sharing and interoperable IOC…
volexity/threat-intelSignatures and IoCs from public Volexity blog posts.
misp/misp-taxonomiesTaxonomies used in MISP taxonomy system and can be used by other information sharing tool.
vxunderground/threatintelligencediscordbotGets updates from various clearnet domains and ransomware threat actor domains
bushidouk/abused-legitimate-servicesCloud, CDN, and marketing services leveraged by cybercriminals and APT groups
gendigitalinc/iocThreat Intel IoCs + bits and pieces of dark matter. Published by Gen Threat Labs.
ransomlook/ransomlookYet another Ransomware gang tracker
threatlabz/iocsThis repository is for Indicators of Compromise (IOCs) from Zscaler ThreatLabz public reports
criticalpathsecurity/zeek-intelligence-feedsAggregated Zeek-format threat intelligence feeds with combined indicators from public and curated sources for continuous IDS and network threat…
fastfire/ioc_attack_esxi_feb_2023Collection of IoCs available and related to attacks on ESXi infrastructures that occurred as of Friday February 3, 2023.
