AbuseIPDB
Community-reported abusive IP database with a free lookup API.
AlienVault OTX
Open Threat Exchange: community pulses of IOCs and an API for enrichment.
Feodo Tracker
Tracks botnet command-and-control servers and publishes blocklists.
GreyNoise
Tells you which IPs are mass-scanning the internet so you can separate background noise from targeted activity.
MISP
Open-source threat intel sharing platform used by CERTs and ISACs worldwide.
OpenCTI
Open-source platform for structuring threat intel on the STIX 2 model.
Pulsedive
Free threat intel platform for enriching and pivoting on IOCs.
RansomLook
Open-source ransomware leak-site and forum monitor.
Ransomware.live
Tracks ransomware leak-site posts and victims in near real time.
Talos Intelligence
Cisco Talos reputation lookups and threat research.
ThreatFox
Community IOC sharing platform from abuse.ch, with a free API.
URLhaus
abuse.ch database of malicious URLs used for malware distribution.