Threat Intel

Crowd-sourced IP address reputation and abuse reports for blocking malicious traffic.

Looks up threat intelligence on IPs, domains, URLs, and files: malware, passive DNS, and geo data.

Search engine for internet-connected hosts: open ports, services, certificates and banners.

Daily JSON feed of exploited CVEs with CVSS/EPSS scores and CISA KEV status, no key needed.

Reputation and risk score for an email address from breach, blacklist, and abuse signals.

Directory of adblock/host filter lists with metadata: license, syntax, language, maintainer, tags per list.

Community-flagged database of phishing domains and URLs, with a live WebSocket feed of new entries.

Cyberspace mapping search engine for finding and analyzing internet-exposed devices, services and assets.

Attack-surface intelligence: domain and subdomain details, host data, and internet-wide asset discovery.

Scans text or files for exposed secrets like API keys and credentials, with a free 10k-call/month tier.

Checks passwords against breach data (k-anonymity, no key) and looks up known data-breach exposure by domain.

Submits and looks up automated behavioral malware analysis reports powered by CrowdStrike Falcon Sandbox.

Search leaked data, darknet content, pastes and archived public web pages by term or selector.

Detects VPN, proxy and Tor traffic per-request using 25+ network and client signals.

Community-sourced blacklist to check and report abusive IP addresses by threat type.

Daily-updated feed of malware sample metadata: hashes, threat level, family, and dropped files.

Community malware sample repository: hash lookups, search, file downloads and daily sample lists.

Detonates files, URLs, commands and documents in a sandbox VM and returns a scored verdict with IOCs.

Crowdsourced malware sample database: lookup and download samples by hash, YARA rule or ClamAV signature.

Official Microsoft security bulletin and CVE data in CVRF/CSAF format, no key needed.

US government database of CVE vulnerability records with CVSS scores, descriptions and references.

Searchable phishing URL, IP, and domain database with ML confidence scores, updated every 90 minutes.

Threat intelligence lookups for IPs, domains, and URLs with risk scoring and IOC enrichment.

Scans uploaded files for malware and threats across multiple detection engines, with regional data residency.

Scans URLs for malware and phishing in a sandboxed browser; search past scans by domain, IP or ASN.

Current and historical DNS, WHOIS and domain/IP intelligence for security and threat-research tools.

Searches internet-connected devices for open ports, services, banners and known vulnerabilities.

AI-clustered threat intel: incident clusters, IOCs, CVEs, APT profiles, ransomware leak-site data.

Database of malicious URLs and malware samples used for phishing and malware distribution.

Search public website scans for screenshots, DOM snapshots, and phishing/malware threat indicators.

Scans submitted files or URLs for malware and NSFW content, credit-metered, GDPR-compliant.

Scans files, URLs, domains and IPs against dozens of antivirus engines and blocklists.

Domain and IP reputation/safe-browsing scores from WOT's user community and ML models.