threat-intelligence-feeds

DNS-Blocklists: For a better internet - keep the internet clean!

Open-source cyber threat intelligence workstation for OSINT triage, Threat Actor Profiles, AI-assisted analysis, and hunt-query generation.

lists to spam a lot of rubbish ... hand-curated to fight spammers and phishing harassing poor italian (domain.it) mailboxes #spamrevenge

Automated IP blacklist aggregator from 23 threat intelligence sources - updated hourly via GitHub Actions

A nonprofit, open-source vulnerability disclosure platform built for security researchers.

A public, research-focused dataset of expired, and recently dropped domains curated for cybersecurity analysis, brand monitoring, threat intelligence, and market research.

Open-source Python CTI pipeline that collects and enriches IoCs from five feeds, generates a Plotly dashboard and CSV export, and forecasts seven-day threat trends for SOC analysts.

A Python Flask web dashboard that aggregates and displays the latest cybersecurity news from multiple RSS feeds, organized by category. Quickly see titles, summaries, and publication dates of top threat intelligence sources.

🛡️ Curated collection of 300+ free, open-source and some commercial Threat Intelligence feeds – IP, DNS, URL, hashes, CVEs, MISP and more with auto-validated and status-checked daily via GitHub Actions.

APT infrastructure intelligence and IOC tracking platform

threatXmanager is an open source SDK by CorreaCyberLabsLTD for cyber threat intelligence management and incident response. Built on a STIX2 schema, it centralizes observables analysis and integrates with tools like MISP, TheHive, and MITRE ATT&CK.

Threat Intelligence is a branch of cybersecurrity that involves gathering information about adversaries, their infrastructure, motives, TTPs, and history. This project covers an investigation into "Nexus Zeta", following an uptick in cyber attacks across Europe targeting government sectors and critical infrastructure.

Talos - The Automaton Engine: Building ML Shields for Modern Threat Detection.

Full teardown of the Kyber ransomware Windows encryptor. Six corrections to public reporting, each independently verifiable. Includes analysis tooling, detection content, and incident response guidance.

Self-hosted CTI pipeline: 20+ RSS feeds, Claude AI triage, relevance scoring. n8n + Docker + AWS. Under $12/month.

AI-powered Cyber Threat Intelligence Platform for real-time threat detection, log analysis, anomaly detection, and SOC dashboard monitoring.

Evaluation of 5 free public threat intelligence feeds (URLhaus, Feodo Tracker, AlienVault OTX, Emerging Threats Open, CISA KEV) against MISP and Microsoft Sentinel integration criteria, with data-backed prioritization.

First-hand technical intelligence on the Orova data-extortion group. Four Tor services (two previously unreported), full extortion lifecycle with dates, 36-victim dataset, operator tradecraft analysis, and Sigma rules. Includes two reusable methods: CUID leak-site timeline reconstruction and C2PA provenance in ransomware branding.

Automated CTI aggregator producing validated, deduplicated and firewall-ready IP, hash and URL threat feeds every hour.