Welcome to "EasyThreat"

This tool is designed to point SOC Analysts and Threat Hunters in the right direction when looking to enrich an indicator for analysis. Many defenders do not have the level of automation that they would like for this task. Use these tools to check for the presence of your target threat object, on various blacklists, and look up points of enrichment data. For more details on the tools and others, check out the Threat Data page of my Gitbook:

S0cm0nkey's Security Reference Guide: Threat Data

**Note: You must allow popups from this page for this tool to work correctly**

Enter Threat Object in the search bar, then launch a tool to navigate directly to its report on the Threat Object.

Blue: Single Tools, Green: Launches Multiple Tools, Red: Requires Manual Input, Yellow: Manual Input Multiple Objects

Multi-Blacklist Checkers: These are tools that take a domain or IP adddress and search accross multiple blacklists. These will often have more data than just reputation. Read the details for more information.

All Multi-Blacklist Checkers HurricaneElectric VirusTotal Cisco Talos MXToolbox Supertool MultiRBL

IP Address Only Reputation Checkers: These are tools that will look for the presence of an IP address on different blacklists.

All IP Address Reputation Checkers HackedIP HoneyDB AbuseIPDB Blocklist.de Project Honeypot Greynoise IP Lookup DNSBL IPVoid IPSpamList Cymru IP Bulk Lookup InfoByIP Bulk Lookup

Proxy/VPN/TOR Checkers: These are tools will veryify if an IP is used as a form of proxy such as TOR or VPN Exit Node.

All Proxy/VPN/TOR Checkers IPQualityScoreVPN ExoneraTOR VPNAPI IP2Proxy

Domain Only Reputation Checkers: These are tools that will look for the presence of a Domain on different blacklists.

All Domain Reputation Checkers URLVoid AdGuard Blocklist Securi Site-Check Malware Domains Blacklist URLScan MergiTools Blacklist Check DZscalar Zulu Scanner Quttera Website Scanner PhishTank Living-off-trusted-sites

Threat Intelligence Platforms: These are platforms with vast intelligence on various indicators. Some have a portal for accessing some intelligence for free.

All Intel Platform IBM Xforce AlienVault OTX ThreatConnect

Threat Enrichment Tools: These are tools can be used to return contextual data for the target Threat Object.

All Threat Enrichment Tools ThreatCrowd (OTX) ThreatFox SANS D-Shield Data ThreatIntelligencePlatform.com RiskIQ Community Data Malc0de Database Abusix Blocklist Check BrightCloud OPSWAT MetaDefender Pulsedive Threat Intelligence ThreatShare Malware Data PhishStats Dashboard #2 TweetIOC Indicator Search

Cyber Search Engines and Internet Scanners: These are tools can be used to return miscellaneous data for the target Threat Object.

All Cyber Search Engines and Internet Scanners Shodan Spyse Maltiverse Onyphe IntelX Natlas Internet Scanner TrendMicro Threat Encyclopedia BinaryEdge Censys LeakIX Synapsint Guardicore Threat Intelligence ThreatMiner