Investigators

Interactive threat-analysis sandbox

Best for: Use it when an authorized suspicious sample or URL needs behavioral analysis and visual triage.

IP, domain, and email reputation intelligence

Best for: Use it when an indicator needs reputation or sender context from a major threat-intelligence provider.

Open threat-intelligence community pulses

Best for: Use it when an indicator needs community threat-intelligence context and related indicators.

Open-source threat-intelligence sharing platform

Best for: Use it when a team needs controlled threat-intelligence sharing, correlation, and internal/private community workflows.

Free web-based DNS and domain lookup tools

Best for: Use it when a domain investigation needs quick manual pivots across several lightweight DNS and hosting checks.

Reverse analytics, DNS, and domain intelligence

Best for: Use it when a website or domain needs passive pivots through analytics IDs, ad IDs, DNS clues, or…

Internet asset search and exposure intelligence

Best for: Use it when a scoped host, service, product, or organization needs additional exposure context beyond Shodan or Censys.

Cyber defense search engine and attack-surface data

Best for: Use it when a technical artifact needs passive cyber-intelligence enrichment and historical context.

Internet asset and attack-surface search

Best for: Use it when infrastructure research needs another structured lens on internet-exposed assets and certificates.

Internet scanning and risk intelligence

Best for: Use it when a security workflow needs another passive dataset for exposed-service and infrastructure context.

Street-level imagery platform for geolocation and scene context

Best for: Corroborating roads, storefronts, landmarks, signage, and local scene context in geolocation workflows.