Publicly available security research tools
Below is a list of publicly available resources I have experience with. This list is certainly not exhaustive. Also note that IOCs can be malicious in the absence of hits/reports at these sources. However, they can help you build context while researching or performing analysis.
General IOC validation
Resources will be presented in Chrome’s saved search format, where the search term is replaced with %s.
| Resource | File hash | Domain | IP address | URL | Notes | Search Format | API Documentation |
|---|---|---|---|---|---|---|---|
| AbuseIPDB | ❌ | ✅ | ✅ | ❌ | https://www.abuseipdb.com/check/%s | https://docs.abuseipdb.com/ | |
| VirusTotal | ✅ | ✅ | ✅ | ❌ | https://www.virustotal.com/gui/search/%s | https://docs.virustotal.com/reference/overview | |
| Spur Context API | ❌ | ❌ | ✅ | ❌ | Can identify residential/anonymizing proxy and VPN use. Free tier does not include API keys, but can be used to search in the browser. | https://app.spur.us/context?q=%s | https://docs.spur.us/context-api |
| URLScan | ❌ | ✅ | ✅ | ✅ | Searches can show full HTTP request chains, redirects, and other behaviors related to a URL. | https://urlscan.io/search/#%s | https://urlscan.io/docs/api/ |
Network exposure
The following tools can be used to assess network exposure, such as ports or services open to the internet.
| Resource | Search Format | API Documentation |
|---|---|---|
| Shodan | https://www.shodan.io/host/%s | https://developer.shodan.io/ |
| Censys | https://search.censys.io/hosts/%s | https://search.censys.io/api |