threatfox

Malwoverview is a first response tool for threat hunting across VirusTotal, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, ThreatFox, Triage, IPInfo, Shodan, AbuseIPDB, GreyNoise, URLScan.io, Whois/RDAP, NIST, and VulnCheck. Supports LLM enrichment, IOC extraction, YARA scanning, and Android analysis.

Machine-readable .txt IP blocklist from ThreatFox by Abuse.ch, updated every hour.

Threatfox Censys is a tool to query Censys Search for IP addresses and domains and then parses the JSON and submits the results to Threatfox.

Small collection of tools to help speed up malware and CTI analysis.

FortiEDR Threat Intelligence Database. ThreatFox Threat Intelligence Database Integration with FortiEDR

Malware samples and IOCs captured from honeypots and reported to MalwareBazaar, ThreatFox and VirusTotal

PowerShell hash lookup against MalwareBazaar & ThreatFox with HTML reports

CLI tool to search in ThreatFox IOC database

Predict market trends using AI agents that analyze live data and run simulations to deliver accurate probability forecasts.

Fetches 1–7 days of ThreatFox IOCs, displays color-coded results to terminal, and exports to CSV

🚨 Automated Telegram bot (n8n) for C2 threat intel — pulls ThreatFox & OSINT IOC feeds, filters by malware family (Cobalt Strike/Havoc), and enriches IPs via Shodan, geolocation, and DNS for real-time analyst reporting.

Esto es Dirty-Lands, un proyecto Cowrie + Dionaea cuya propuesta de valor es su rápido despliegue mediante esta documentación, cuenta con: comandos funcionales, un entorno realista, rigurosidad y madurez del proyecto. Además con plena capacidad de reportar cada evento vía Telegram y las maldades a sus respectivas plataformas y la observabilidad.

VATEX Intelligence Server ( Intelligence + Lina(Latin) )

PowerShell toolkit that turns SentinelOne, CyberArk EPM, VirusTotal, MalwareBazaar, Hybrid Analysis and ThreatFox API data into explainable review findings, with one guarded remediation workflow. Built from public API docs; contracts tested against a local mock server, not real tenants.

ThreatFox MCP — abuse.ch indicator-of-compromise feed (free, key required)

Multi-source bug and vulnerability analysis pipeline aggregating data from ThreatFox, URLhaus, NVD, CISA KEV, GitHub, GitLab, and OSV.dev with interactive Plotly visualizations.

2026 IP Threat Intelligence Blocklist: Hourly Updated Abuse.ch Feed