256 sources · 106 providers
Threat Intel Data Sources
Pick a category, vendor, actor or data point; get the public source.
Sources by category and provider
Vulns and advisoriesThreat activityExposure and reconReference
Area is the number of sources; each block is a category split by provider, coloured by family. Hover for counts, click to filter the table, click empty space to reset. Data: the pwnsy source registry; a source tagged in two categories counts in both.
Background readingMITRE ATT&CKThe KEV catalogOSINT recon
| Vulnerabilities / CVEs 100 | ||||
| National Vulnerability DatabaseNVD | Vulnerabilities / CVEs | CVE detail | CVE | nvd.nist.gov |
| CVE Program: official record searchCVE.org | Vulnerabilities / CVEs | any | CVE | cve.org |
| CVE Details: browse by vendor / scoreCVEDetails | Vulnerabilities / CVEs | CVSS score | cvedetails.com | |
| Known Exploited Vulnerabilities (KEV) catalogCISA | Vulnerabilities / CVEs | KEV (known exploited) | CISA KEV | cisa.gov |
| Vulners: vuln + exploit aggregatorVulners | Vulnerabilities / CVEs | any | vulners.com | |
| VulnCheck KEV: community known-exploited catalog (broader than CISA)VulnCheck | Vulnerabilities / CVEs | Exploit / PoC | CISA KEV | vulncheck.com |
| Exploit Intelligence: CVSS × EPSS risk matrixPwnsy Data | Vulnerabilities / CVEs | EPSS probability | EPSS | data.pwnsy.com |
| OWASP Top 10: web application risksOWASP | Vulnerabilities / CVEs | Advisory | owasp.org | |
| EU Vulnerability Database (EUVD)ENISA | Vulnerabilities / CVEs | CVE detail | CVE | euvd.enisa.europa.eu |
| OpenCVE: browse & track CVEsOpenCVE | Vulnerabilities / CVEs | CVE detail | CVE | app.opencve.io |
| VulDB: vulnerability database & statsVulDB | Vulnerabilities / CVEs | CVE detail | vuldb.com | |
| Vulnerability-Lookup (CIRCL): CVE + advisories aggregatorCIRCL | Vulnerabilities / CVEs | CVE detail | vulnerability.circl.lu | |
| NVD CVSS severity distribution over time: chartsNVD | Vulnerabilities / CVEs | CVSS score | CVSS | nvd.nist.gov |
| CVE.icu: CVE statistics & charts (year / vendor / CNA)CVE.icu | Vulnerabilities / CVEs | CVE detail | CVE | cve.icu |
| CVECrowd: CVEs trending on social right nowCVECrowd | Vulnerabilities / CVEs | CVE detail | CVE | cvecrowd.com |
| MSRC Security Update Guide (Patch Tuesday)Microsoft | Vulnerabilities / CVEs | Advisory | Microsoft | msrc.microsoft.com |
| Microsoft CVEs: NVD searchNVD | Vulnerabilities / CVEs | CVE detail | Microsoft | nvd.nist.gov |
| Microsoft: CVE Record searchCVE.org | Vulnerabilities / CVEs | CVE detail | Microsoft, CVE | cve.org |
| Microsoft: Vulners (CVE + exploits)Vulners | Vulnerabilities / CVEs | any | Microsoft | vulners.com |
| Apple CVEs: NVD searchNVD | Vulnerabilities / CVEs | CVE detail | Apple | nvd.nist.gov |
| Apple: CVE Record searchCVE.org | Vulnerabilities / CVEs | CVE detail | Apple, CVE | cve.org |
| Apple: Vulners (CVE + exploits)Vulners | Vulnerabilities / CVEs | any | Apple | vulners.com |
| Google CVEs: NVD searchNVD | Vulnerabilities / CVEs | CVE detail | nvd.nist.gov | |
| Google: CVE Record searchCVE.org | Vulnerabilities / CVEs | CVE detail | Google, CVE | cve.org |
| Google: Vulners (CVE + exploits)Vulners | Vulnerabilities / CVEs | any | vulners.com | |
| Cisco CVEs: NVD searchNVD | Vulnerabilities / CVEs | CVE detail | Cisco | nvd.nist.gov |
| Cisco: CVE Record searchCVE.org | Vulnerabilities / CVEs | CVE detail | Cisco, CVE | cve.org |
| Cisco: Vulners (CVE + exploits)Vulners | Vulnerabilities / CVEs | any | Cisco | vulners.com |
| Fortinet CVEs: NVD searchNVD | Vulnerabilities / CVEs | CVE detail | Fortinet | nvd.nist.gov |
| Fortinet: CVE Record searchCVE.org | Vulnerabilities / CVEs | CVE detail | Fortinet, CVE | cve.org |
| Fortinet: Vulners (CVE + exploits)Vulners | Vulnerabilities / CVEs | any | Fortinet | vulners.com |
| Palo Alto CVEs: NVD searchNVD | Vulnerabilities / CVEs | CVE detail | Palo Alto | nvd.nist.gov |
| Palo Alto: CVE Record searchCVE.org | Vulnerabilities / CVEs | CVE detail | Palo Alto, CVE | cve.org |
| Palo Alto: Vulners (CVE + exploits)Vulners | Vulnerabilities / CVEs | any | Palo Alto | vulners.com |
| VMware CVEs: NVD searchNVD | Vulnerabilities / CVEs | CVE detail | VMware | nvd.nist.gov |
| VMware: CVE Record searchCVE.org | Vulnerabilities / CVEs | CVE detail | VMware, CVE | cve.org |
| VMware: Vulners (CVE + exploits)Vulners | Vulnerabilities / CVEs | any | VMware | vulners.com |
| Citrix CVEs: NVD searchNVD | Vulnerabilities / CVEs | CVE detail | Citrix | nvd.nist.gov |
| Citrix: CVE Record searchCVE.org | Vulnerabilities / CVEs | CVE detail | Citrix, CVE | cve.org |
| Citrix: Vulners (CVE + exploits)Vulners | Vulnerabilities / CVEs | any | Citrix | vulners.com |
| Ivanti CVEs: NVD searchNVD | Vulnerabilities / CVEs | CVE detail | Ivanti | nvd.nist.gov |
| Ivanti: CVE Record searchCVE.org | Vulnerabilities / CVEs | CVE detail | Ivanti, CVE | cve.org |
| Ivanti: Vulners (CVE + exploits)Vulners | Vulnerabilities / CVEs | any | Ivanti | vulners.com |
| Oracle CVEs: NVD searchNVD | Vulnerabilities / CVEs | CVE detail | Oracle | nvd.nist.gov |
| Oracle: CVE Record searchCVE.org | Vulnerabilities / CVEs | CVE detail | Oracle, CVE | cve.org |
| Oracle: Vulners (CVE + exploits)Vulners | Vulnerabilities / CVEs | any | Oracle | vulners.com |
| Adobe CVEs: NVD searchNVD | Vulnerabilities / CVEs | CVE detail | Adobe | nvd.nist.gov |
| Adobe: CVE Record searchCVE.org | Vulnerabilities / CVEs | CVE detail | Adobe, CVE | cve.org |
| Adobe: Vulners (CVE + exploits)Vulners | Vulnerabilities / CVEs | any | Adobe | vulners.com |
| Apache CVEs: NVD searchNVD | Vulnerabilities / CVEs | CVE detail | Apache | nvd.nist.gov |
| Apache: CVE Record searchCVE.org | Vulnerabilities / CVEs | CVE detail | Apache, CVE | cve.org |
| Apache: Vulners (CVE + exploits)Vulners | Vulnerabilities / CVEs | any | Apache | vulners.com |
| Linux Kernel CVEs: NVD searchNVD | Vulnerabilities / CVEs | CVE detail | Linux Kernel | nvd.nist.gov |
| Linux Kernel: CVE Record searchCVE.org | Vulnerabilities / CVEs | CVE detail | Linux Kernel, CVE | cve.org |
| Linux Kernel: Vulners (CVE + exploits)Vulners | Vulnerabilities / CVEs | any | Linux Kernel | vulners.com |
| WordPress CVEs: NVD searchNVD | Vulnerabilities / CVEs | CVE detail | WordPress | nvd.nist.gov |
| WordPress: CVE Record searchCVE.org | Vulnerabilities / CVEs | CVE detail | WordPress, CVE | cve.org |
| WordPress: Vulners (CVE + exploits)Vulners | Vulnerabilities / CVEs | any | WordPress | vulners.com |
| OpenSSL CVEs: NVD searchNVD | Vulnerabilities / CVEs | CVE detail | OpenSSL | nvd.nist.gov |
| OpenSSL: CVE Record searchCVE.org | Vulnerabilities / CVEs | CVE detail | OpenSSL, CVE | cve.org |
| OpenSSL: Vulners (CVE + exploits)Vulners | Vulnerabilities / CVEs | any | OpenSSL | vulners.com |
| Atlassian CVEs: NVD searchNVD | Vulnerabilities / CVEs | CVE detail | Atlassian | nvd.nist.gov |
| Atlassian: CVE Record searchCVE.org | Vulnerabilities / CVEs | CVE detail | Atlassian, CVE | cve.org |
| Atlassian: Vulners (CVE + exploits)Vulners | Vulnerabilities / CVEs | any | Atlassian | vulners.com |
| SAP CVEs: NVD searchNVD | Vulnerabilities / CVEs | CVE detail | SAP | nvd.nist.gov |
| SAP: CVE Record searchCVE.org | Vulnerabilities / CVEs | CVE detail | SAP, CVE | cve.org |
| SAP: Vulners (CVE + exploits)Vulners | Vulnerabilities / CVEs | any | SAP | vulners.com |
| Juniper CVEs: NVD searchNVD | Vulnerabilities / CVEs | CVE detail | Juniper | nvd.nist.gov |
| Juniper: CVE Record searchCVE.org | Vulnerabilities / CVEs | CVE detail | Juniper, CVE | cve.org |
| Juniper: Vulners (CVE + exploits)Vulners | Vulnerabilities / CVEs | any | Juniper | vulners.com |
| SonicWall CVEs: NVD searchNVD | Vulnerabilities / CVEs | CVE detail | SonicWall | nvd.nist.gov |
| SonicWall: CVE Record searchCVE.org | Vulnerabilities / CVEs | CVE detail | SonicWall, CVE | cve.org |
| SonicWall: Vulners (CVE + exploits)Vulners | Vulnerabilities / CVEs | any | SonicWall | vulners.com |
| GitLab CVEs: NVD searchNVD | Vulnerabilities / CVEs | CVE detail | GitLab | nvd.nist.gov |
| GitLab: CVE Record searchCVE.org | Vulnerabilities / CVEs | CVE detail | GitLab, CVE | cve.org |
| GitLab: Vulners (CVE + exploits)Vulners | Vulnerabilities / CVEs | any | GitLab | vulners.com |
| Jenkins CVEs: NVD searchNVD | Vulnerabilities / CVEs | CVE detail | Jenkins | nvd.nist.gov |
| Jenkins: CVE Record searchCVE.org | Vulnerabilities / CVEs | CVE detail | Jenkins, CVE | cve.org |
| Jenkins: Vulners (CVE + exploits)Vulners | Vulnerabilities / CVEs | any | Jenkins | vulners.com |
| F5 BIG-IP CVEs: NVD searchNVD | Vulnerabilities / CVEs | CVE detail | F5 BIG-IP | nvd.nist.gov |
| F5 BIG-IP: CVE Record searchCVE.org | Vulnerabilities / CVEs | CVE detail | F5 BIG-IP, CVE | cve.org |
| F5 BIG-IP: Vulners (CVE + exploits)Vulners | Vulnerabilities / CVEs | any | F5 BIG-IP | vulners.com |
| Zoho CVEs: NVD searchNVD | Vulnerabilities / CVEs | CVE detail | Zoho | nvd.nist.gov |
| Zoho: CVE Record searchCVE.org | Vulnerabilities / CVEs | CVE detail | Zoho, CVE | cve.org |
| Zoho: Vulners (CVE + exploits)Vulners | Vulnerabilities / CVEs | any | Zoho | vulners.com |
| MongoDB CVEs: NVD searchNVD | Vulnerabilities / CVEs | CVE detail | MongoDB | nvd.nist.gov |
| MongoDB: CVE Record searchCVE.org | Vulnerabilities / CVEs | CVE detail | MongoDB, CVE | cve.org |
| MongoDB: Vulners (CVE + exploits)Vulners | Vulnerabilities / CVEs | any | MongoDB | vulners.com |
| Redis CVEs: NVD searchNVD | Vulnerabilities / CVEs | CVE detail | Redis | nvd.nist.gov |
| Redis: CVE Record searchCVE.org | Vulnerabilities / CVEs | CVE detail | Redis, CVE | cve.org |
| Redis: Vulners (CVE + exploits)Vulners | Vulnerabilities / CVEs | any | Redis | vulners.com |
| nginx CVEs: NVD searchNVD | Vulnerabilities / CVEs | CVE detail | nginx | nvd.nist.gov |
| nginx: CVE Record searchCVE.org | Vulnerabilities / CVEs | CVE detail | nginx, CVE | cve.org |
| nginx: Vulners (CVE + exploits)Vulners | Vulnerabilities / CVEs | any | nginx | vulners.com |
| Progress (MOVEit) CVEs: NVD searchNVD | Vulnerabilities / CVEs | CVE detail | Progress (MOVEit) | nvd.nist.gov |
| Progress (MOVEit): CVE Record searchCVE.org | Vulnerabilities / CVEs | CVE detail | Progress (MOVEit), CVE | cve.org |
| Progress (MOVEit): Vulners (CVE + exploits)Vulners | Vulnerabilities / CVEs | any | Progress (MOVEit) | vulners.com |
| Veeam CVEs: NVD searchNVD | Vulnerabilities / CVEs | CVE detail | Veeam | nvd.nist.gov |
| Veeam: CVE Record searchCVE.org | Vulnerabilities / CVEs | CVE detail | Veeam, CVE | cve.org |
| Veeam: Vulners (CVE + exploits)Vulners | Vulnerabilities / CVEs | any | Veeam | vulners.com |
| Exploits & PoCs 5 | ||||
| Exploit Database (Offensive Security)Exploit-DB | Exploits & PoCs | Exploit / PoC | exploit-db.com | |
| Metasploit module / vuln DBRapid7 | Exploits & PoCs | Exploit / PoC | rapid7.com | |
| Sploitus: exploit & PoC search engineSploitus | Exploits & PoCs | Exploit / PoC | sploitus.com | |
| Packet Storm: exploits & advisoriesPacket Storm | Exploits & PoCs | Exploit / PoC | packetstormsecurity.com | |
| Nuclei templatesProjectDiscovery | Exploits & PoCs | Exploit / PoC | github.com | |
| Malware 7 | ||||
| VirusTotal: file / URL / IP scanningVirusTotal | Malware | IOC lookup | virustotal.com | |
| MalwareBazaar: malware sample repoabuse.ch | Malware | Malware sample | bazaar.abuse.ch | |
| Malpedia: malware & actor encyclopediaMalpedia | Malware | Threat report | malpedia.caad.fkie.fraunhofer.de | |
| YARAify: scan & hunt with YARAabuse.ch | Malware | YARA / detection | YARA | yaraify.abuse.ch |
| Bitdefender Cyberthreat Real-Time MapBitdefender | Malware | Threat report | threatmap.bitdefender.com | |
| AV-ATLAS: real-time malware, PUA & spam statisticsAV-ATLAS | Malware | Malware sample | portal.av-atlas.org | |
| MalwareBazaar statistics: charts & trendsabuse.ch | Malware | Malware sample | bazaar.abuse.ch | |
| Ransomware 14 | ||||
| Ransomware.live: leak sites & victimsransomware.live | Ransomware | Threat report | ransomware.live | |
| RansomLook: ransomware group trackerRansomLook | Ransomware | Threat report | ransomlook.io | |
| No More Ransom: decryptorsNo More Ransom | Ransomware | any | nomoreransom.org | |
| ID Ransomware: identify a strainMalwareHunterTeam | Ransomware | any | id-ransomware.malwarehunterteam.com | |
| Ransomware crews: leak-site profiles & activityPwnsy Data | Ransomware | Threat report | data.pwnsy.com | |
| eCrime.ch: ransomware & extortion statisticseCrime.ch | Ransomware | Threat report | ecrime.ch | |
| Ransomwhere: ransomware payment tracker (charts)Ransomwhere | Ransomware | Threat report | ransomwhe.re | |
| LockBit: victims & activityransomware.live | Ransomware | Threat report | LockBit | ransomware.live |
| ALPHV / BlackCat: victims & activityransomware.live | Ransomware | Threat report | ALPHV / BlackCat | ransomware.live |
| Cl0p: victims & activityransomware.live | Ransomware | Threat report | Cl0p | ransomware.live |
| Black Basta: victims & activityransomware.live | Ransomware | Threat report | Black Basta | ransomware.live |
| Play: victims & activityransomware.live | Ransomware | Threat report | Play | ransomware.live |
| Akira: victims & activityransomware.live | Ransomware | Threat report | Akira | ransomware.live |
| RansomHub: victims & activityransomware.live | Ransomware | Threat report | RansomHub | ransomware.live |
| Phishing 6 | ||||
| URLhaus: malicious URL databaseabuse.ch | Phishing | IOC lookup | urlhaus.abuse.ch | |
| PhishTank: verified phishing URLsPhishTank | Phishing | IOC lookup | phishtank.org | |
| OpenPhish: phishing feedOpenPhish | Phishing | IOC lookup | openphish.com | |
| urlscan.io: scan & screenshot URLsurlscan.io | Phishing | IOC lookup | urlscan.io | |
| URLhaus statistics: charts & trendsabuse.ch | Phishing | IOC lookup | urlhaus.abuse.ch | |
| Safe Browsing transparency: unsafe sites over time (charts)Google | Phishing | Threat report | transparencyreport.google.com | |
| IOCs / Indicators 12 | ||||
| ThreatFox: IOC databaseabuse.ch | IOCs / Indicators | IOC lookup | threatfox.abuse.ch | |
| AbuseIPDB: IP reputation lookupAbuseIPDB | IOCs / Indicators | IOC lookup | abuseipdb.com | |
| OTX: Open Threat Exchange pulsesAlienVault | IOCs / Indicators | IOC lookup | otx.alienvault.com | |
| GreyNoise: internet scan noise / IP intelGreyNoise | IOCs / Indicators | IOC lookup | viz.greynoise.io | |
| Spamhaus: IP / domain reputation checkerSpamhaus | IOCs / Indicators | IOC lookup | check.spamhaus.org | |
| Shadowserver: daily exploitation activity dashboardShadowserver | IOCs / Indicators | C2 tracker | dashboard.shadowserver.org | |
| X-Force Exchange: threat intel data & IOC dashboardsIBM X-Force | IOCs / Indicators | IOC lookup | exchange.xforce.ibmcloud.com | |
| Pulsedive: threat intel & IOC searchPulsedive | IOCs / Indicators | IOC lookup | pulsedive.com | |
| Live Cyber Threat MapCheck Point | IOCs / Indicators | Threat report | threatmap.checkpoint.com | |
| FortiGuard Threat Map (live)Fortinet | IOCs / Indicators | Threat report | fortiguard.fortinet.com | |
| Kaspersky Cyberthreat Real-Time MapKaspersky | IOCs / Indicators | Threat report | cybermap.kaspersky.com | |
| Internet Storm Center: attack & port-activity dashboardsSANS ISC | IOCs / Indicators | Threat report | isc.sans.edu | |
| Threat Actors / APTs 26 | ||||
| Threat Groups: full actor DB (1,100+ APTs, ransomware crews, sanctioned)Pwnsy Data | Threat Actors / APTs | TTP mapping | MITRE ATT&CK | data.pwnsy.com |
| ATT&CK: adversary TTP knowledge baseMITRE ATT&CK | Threat Actors / APTs | TTP mapping | MITRE ATT&CK | attack.mitre.org |
| Mandiant: threat research blogMandiant | Threat Actors / APTs | Threat report | cloud.google.com | |
| Talos Intelligence: research blogCisco Talos | Threat Actors / APTs | Threat report | blog.talosintelligence.com | |
| Unit 42 (Palo Alto): threat researchUnit 42 | Threat Actors / APTs | Threat report | unit42.paloaltonetworks.com | |
| Microsoft Threat Intelligence blogMicrosoft | Threat Actors / APTs | Threat report | microsoft.com | |
| Threat Analysis Group blogGoogle TAG | Threat Actors / APTs | Threat report | blog.google | |
| Adversary Universe: actor profilesCrowdStrike | Threat Actors / APTs | Threat report | adversary.crowdstrike.com | |
| The DFIR Report: intrusion writeupsThe DFIR Report | Threat Actors / APTs | Threat report | thedfirreport.com | |
| Recorded Future: research & reportsRecorded Future | Threat Actors / APTs | Threat report | recordedfuture.com | |
| ATT&CK Navigator: interactive TTP matrixMITRE | Threat Actors / APTs | TTP mapping | MITRE ATT&CK | mitre-attack.github.io |
| Lazarus Group: ATT&CK group (G0032)MITRE ATT&CK | Threat Actors / APTs | TTP mapping | Lazarus Group, MITRE ATT&CK | attack.mitre.org |
| Kimsuky: ATT&CK group (G0094)MITRE ATT&CK | Threat Actors / APTs | TTP mapping | Kimsuky, MITRE ATT&CK | attack.mitre.org |
| APT28: ATT&CK group (G0007)MITRE ATT&CK | Threat Actors / APTs | TTP mapping | APT28, MITRE ATT&CK | attack.mitre.org |
| APT29: ATT&CK group (G0016)MITRE ATT&CK | Threat Actors / APTs | TTP mapping | APT29, MITRE ATT&CK | attack.mitre.org |
| APT41: ATT&CK group (G0096)MITRE ATT&CK | Threat Actors / APTs | TTP mapping | APT41, MITRE ATT&CK | attack.mitre.org |
| Sandworm: ATT&CK group (G0034)MITRE ATT&CK | Threat Actors / APTs | TTP mapping | Sandworm, MITRE ATT&CK | attack.mitre.org |
| Volt Typhoon: ATT&CK group (G1017)MITRE ATT&CK | Threat Actors / APTs | TTP mapping | Volt Typhoon, MITRE ATT&CK | attack.mitre.org |
| Turla: ATT&CK group (G0010)MITRE ATT&CK | Threat Actors / APTs | TTP mapping | Turla, MITRE ATT&CK | attack.mitre.org |
| MuddyWater: ATT&CK group (G0069)MITRE ATT&CK | Threat Actors / APTs | TTP mapping | MuddyWater, MITRE ATT&CK | attack.mitre.org |
| OilRig (APT34): ATT&CK group (G0049)MITRE ATT&CK | Threat Actors / APTs | TTP mapping | OilRig (APT34), MITRE ATT&CK | attack.mitre.org |
| Charming Kitten: ATT&CK group (G0059)MITRE ATT&CK | Threat Actors / APTs | TTP mapping | Charming Kitten, MITRE ATT&CK | attack.mitre.org |
| APT33: ATT&CK group (G0064)MITRE ATT&CK | Threat Actors / APTs | TTP mapping | APT33, MITRE ATT&CK | attack.mitre.org |
| FIN7: ATT&CK group (G0046)MITRE ATT&CK | Threat Actors / APTs | TTP mapping | FIN7, MITRE ATT&CK | attack.mitre.org |
| Scattered Spider: ATT&CK group (G1015)MITRE ATT&CK | Threat Actors / APTs | TTP mapping | Scattered Spider, MITRE ATT&CK | attack.mitre.org |
| Conti: ATT&CK group (G0102)MITRE ATT&CK | Threat Actors / APTs | TTP mapping | Conti, MITRE ATT&CK | attack.mitre.org |
| Breaches & Leaks 6 | ||||
| Have I Been Pwned: breach lookupHIBP | Breaches & Leaks | Breach lookup | haveibeenpwned.com | |
| DeHashed: leaked credential searchDeHashed | Breaches & Leaks | Breach lookup | dehashed.com | |
| Intelligence X: leaks & darkweb searchIntelligence X | Breaches & Leaks | Breach lookup | intelx.io | |
| LeakCheck: breach & credential lookupLeakCheck | Breaches & Leaks | Breach lookup | leakcheck.io | |
| DBIR: Data Breach Investigations Report (data & charts)Verizon | Breaches & Leaks | Threat report | verizon.com | |
| World's Biggest Data Breaches: interactive visualizationInformation is Beautiful | Breaches & Leaks | Breach lookup | informationisbeautiful.net | |
| Botnets / C2 3 | ||||
| Feodo Tracker: botnet C2 IPsabuse.ch | Botnets / C2 | C2 tracker | feodotracker.abuse.ch | |
| SSL Blacklist: malicious SSL certs / C2abuse.ch | Botnets / C2 | C2 tracker | sslbl.abuse.ch | |
| C2 Tracker: live C2 infrastructuremontysecurity | Botnets / C2 | C2 tracker | github.com | |
| Sandbox / Detonation 4 | ||||
| Hybrid Analysis: free sandboxHybrid Analysis | Sandbox / Detonation | Malware sample | hybrid-analysis.com | |
| ANY.RUN: interactive sandboxANY.RUN | Sandbox / Detonation | any | any.run | |
| Joe Sandbox: deep malware analysisJoe Sandbox | Sandbox / Detonation | any | joesandbox.com | |
| Triage (Recorded Future): sandboxTriage | Sandbox / Detonation | Malware sample | tria.ge | |
| OSINT / Recon 6 | ||||
| crt.sh: certificate transparency searchcrt.sh | OSINT / Recon | ASN / IP intel | crt.sh | |
| SecurityTrails: DNS / domain historySecurityTrails | OSINT / Recon | any | securitytrails.com | |
| DNSDumpster: DNS recon & mappingDNSDumpster | OSINT / Recon | any | dnsdumpster.com | |
| BGP toolkit: ASN / prefix lookupHurricane Electric | OSINT / Recon | ASN / IP intel | bgp.he.net | |
| ipinfo.io: IP geolocation & ASNipinfo | OSINT / Recon | ASN / IP intel | ipinfo.io | |
| ICANN Lookup: WHOIS / RDAPICANN | OSINT / Recon | any | lookup.icann.org | |
| Attack Surface / Scanning 6 | ||||
| Shodan: internet-connected device searchShodan | Attack Surface / Scanning | ASN / IP intel | shodan.io | |
| Censys Search: hosts & certificatesCensys | Attack Surface / Scanning | any | search.censys.io | |
| FOFA: cyberspace asset searchFOFA | Attack Surface / Scanning | any | fofa.info | |
| ZoomEye: global device searchZoomEye | Attack Surface / Scanning | any | zoomeye.ai | |
| Shadowserver Dashboard: scanning, exploitation & honeypot stats (maps + charts)Shadowserver | Attack Surface / Scanning | Threat report | dashboard.shadowserver.org | |
| LeakIX: exposed services & misconfig indexLeakIX | Attack Surface / Scanning | ASN / IP intel | leakix.net | |
| Dark Web 1 | ||||
| Ahmia: Tor hidden service searchAhmia | Dark Web | any | ahmia.fi | |
| Sanctions 6 | ||||
| OFAC Sanctions List Search (SDN)OFAC | Sanctions | Sanctions check | sanctionssearch.ofac.treas.gov | |
| Treasury: recent sanctions actionsOFAC | Sanctions | any | ofac.treasury.gov | |
| OpenSanctions: persons & entitiesOpenSanctions | Sanctions | Sanctions check | opensanctions.org | |
| EU Sanctions MapEU | Sanctions | any | sanctionsmap.eu | |
| Chainalysis: free crypto sanctions screeningChainalysis | Sanctions | Sanctions check | chainalysis.com | |
| Sanctioned threat actors: OFAC / UK-NCA designatedPwnsy Data | Sanctions | Sanctions check | data.pwnsy.com | |
| Advisories 31 | ||||
| CISA Cybersecurity AdvisoriesCISA | Advisories | Advisory | cisa.gov | |
| Cisco Security AdvisoriesCisco | Advisories | any | Cisco | sec.cloudapps.cisco.com |
| FortiGuard PSIRT advisoriesFortinet | Advisories | any | Fortinet | fortiguard.com |
| Broadcom/VMware Security AdvisoriesVMware | Advisories | any | VMware | broadcom.com |
| Apple security releasesApple | Advisories | any | Apple | support.apple.com |
| Adobe Security BulletinsAdobe | Advisories | any | Adobe | helpx.adobe.com |
| Oracle Critical Patch UpdatesOracle | Advisories | any | Oracle | oracle.com |
| Ivanti Security AdvisoriesIvanti | Advisories | any | Ivanti | ivanti.com |
| Lazarus Group: CISA advisoriesCISA | Advisories | Advisory | Lazarus Group | cisa.gov |
| Kimsuky: CISA advisoriesCISA | Advisories | Advisory | Kimsuky | cisa.gov |
| APT28: CISA advisoriesCISA | Advisories | Advisory | APT28 | cisa.gov |
| APT29: CISA advisoriesCISA | Advisories | Advisory | APT29 | cisa.gov |
| APT41: CISA advisoriesCISA | Advisories | Advisory | APT41 | cisa.gov |
| Sandworm: CISA advisoriesCISA | Advisories | Advisory | Sandworm | cisa.gov |
| Volt Typhoon: CISA advisoriesCISA | Advisories | Advisory | Volt Typhoon | cisa.gov |
| Salt Typhoon: CISA advisoriesCISA | Advisories | Advisory | Salt Typhoon | cisa.gov |
| Turla: CISA advisoriesCISA | Advisories | Advisory | Turla | cisa.gov |
| MuddyWater: CISA advisoriesCISA | Advisories | Advisory | MuddyWater | cisa.gov |
| OilRig (APT34): CISA advisoriesCISA | Advisories | Advisory | OilRig (APT34) | cisa.gov |
| Charming Kitten: CISA advisoriesCISA | Advisories | Advisory | Charming Kitten | cisa.gov |
| APT33: CISA advisoriesCISA | Advisories | Advisory | APT33 | cisa.gov |
| FIN7: CISA advisoriesCISA | Advisories | Advisory | FIN7 | cisa.gov |
| Scattered Spider: CISA advisoriesCISA | Advisories | Advisory | Scattered Spider | cisa.gov |
| Conti: CISA advisoriesCISA | Advisories | Advisory | Conti | cisa.gov |
| LockBit: CISA advisoriesCISA | Advisories | Advisory | LockBit | cisa.gov |
| ALPHV / BlackCat: CISA advisoriesCISA | Advisories | Advisory | ALPHV / BlackCat | cisa.gov |
| Cl0p: CISA advisoriesCISA | Advisories | Advisory | Cl0p | cisa.gov |
| Black Basta: CISA advisoriesCISA | Advisories | Advisory | Black Basta | cisa.gov |
| Play: CISA advisoriesCISA | Advisories | Advisory | Play | cisa.gov |
| Akira: CISA advisoriesCISA | Advisories | Advisory | Akira | cisa.gov |
| RansomHub: CISA advisoriesCISA | Advisories | Advisory | RansomHub | cisa.gov |
| Bug Bounty 4 | ||||
| HackerOne: program directoryHackerOne | Bug Bounty | any | hackerone.com | |
| Bugcrowd: bug bounty programsBugcrowd | Bug Bounty | any | bugcrowd.com | |
| Intigriti: bug bounty programsIntigriti | Bug Bounty | any | intigriti.com | |
| disclose.io: VDP / safe-harbor directorydisclose.io | Bug Bounty | any | disclose.io | |
| DDoS 4 | ||||
| Cloudflare Radar: attack & traffic trendsCloudflare | DDoS | Threat report | radar.cloudflare.com | |
| Cyber Threat Horizon: live DDoS mapNetscout | DDoS | any | horizon.netscout.com | |
| Digital Attack Map: DDoS visualizationArbor | DDoS | any | digitalattackmap.com | |
| Radware Live Threat MapRadware | DDoS | Threat report | livethreatmap.radware.com | |
| ICS / OT 1 | ||||
| ICS AdvisoriesCISA | ICS / OT | Advisory | cisa.gov | |
| Cloud 1 | ||||
| Cloud Vulnerability DBWiz | Cloud | CVE detail | cloudvulndb.org | |
| Supply Chain 5 | ||||
| GitHub Advisory DatabaseGitHub | Supply Chain | CVE detail | github.com | |
| OSV: open source vulnerabilitiesOSV | Supply Chain | CVE detail | osv.dev | |
| Snyk Vulnerability DatabaseSnyk | Supply Chain | any | security.snyk.io | |
| Socket: open source supply-chain riskSocket | Supply Chain | any | socket.dev | |
| deps.dev: dependency & advisory graphdeps.dev | Supply Chain | any | deps.dev | |
| Frameworks and standards 11 | ||||
| CVSS v4.0 calculatorFIRST | Frameworks and standards | CVSS score | CVSS | first.org |
| EPSS data & statistics: live distributionFIRST | Frameworks and standards | EPSS probability | EPSS | first.org |
| CWE: Common Weakness EnumerationMITRE | Frameworks and standards | any | CWE | cwe.mitre.org |
| CAPEC: attack pattern catalogMITRE | Frameworks and standards | any | CAPEC | capec.mitre.org |
| Time-to-exploit: days from CVE publication to CISA KEVPwnsy Data | Frameworks and standards | KEV (known exploited) | CISA KEV | data.pwnsy.com |
| D3FEND: defensive countermeasuresMITRE | Frameworks and standards | any | MITRE D3FEND | d3fend.mitre.org |
| ATLAS: adversarial threats to AI/MLMITRE | Frameworks and standards | any | MITRE ATLAS | atlas.mitre.org |
| Cybersecurity Framework (CSF 2.0)NIST | Frameworks and standards | any | NIST CSF | nist.gov |
| Sigma: generic detection rule repoSigmaHQ | Frameworks and standards | YARA / detection | Sigma | github.com |
| STIX / TAXII: threat-intel exchangeOASIS | Frameworks and standards | any | STIX / TAXII | oasis-open.github.io |
| CWE Top 25 Most Dangerous Software WeaknessesMITRE | Frameworks and standards | Advisory | CWE | cwe.mitre.org |
How the filters work
Sources carry up to five tags. pwnsy data pages rank first, then Exact matches, then by facets matched. Each provider keeps at most six results.
FAQ
How do the filters combine?
A source shows when it matches at least one facet you picked and no tag conflicts. Untagged facets count as a match; Exact matches every pick.
Why do some providers show only six results?
Each provider keeps six at most, so one large catalog such as NVD or CISA cannot fill the list.
Can I share a filtered view?
Yes. Every selection is written to the address bar, so the link opens the same view.
Every link goes to the provider's own public page. Some need a free account. Data pages from pwnsy data.