VirusTotal – Scans files/URLs with 70+ antivirus engines to detect malicious content → https://www.virustotal.com

Hybrid Analysis – Deep malware analysis tool with behavioral reports and sandboxing → https://www.hybrid-analysis.com

ANY.RUN – Interactive malware sandbox and live process visualizer → https://any.run

Joe Sandbox – Advanced malware behavior analysis and threat intelligence tool → https://www.joesandbox.com

Cuckoo Sandbox – Open-source automated malware analysis system → https://cuckoosandbox.org

Talos Intelligence (Cisco) – Reputation data, IP/domain/URL lookup, threat intelligence → https://talosintelligence.com

AlienVault OTX – Real-time threat intelligence sharing and indicator search → https://otx.alienvault.com

AbuseIPDB – Crowd-sourced database of malicious IPs for abuse and attack detection → https://www.abuseipdb.com

IPVoid – Check IP reputation, DNS, blacklist status, and open ports → https://www.ipvoid.com

URLVoid – Analyze websites and check URL reputation using multiple sources → https://www.urlvoid.com

CVE Details – Browse and research vulnerabilities by product, CVE, vendor, etc. → https://www.cvedetails.com

National Vulnerability Database (NVD) – U.S. government repository for CVEs and metrics → https://nvd.nist.gov

Exploit-DB – Archive of public exploits, proof-of-concepts, and offensive security tools → https://www.exploit-db.com

Shodan – Search engine for internet-connected devices, services, ports, and banners → https://www.shodan.io

Maltego – Link analysis and relationship mapping tool for OSINT and investigations → https://www.maltego.com

DNSTwist – Identifies phishing domains by generating and checking typo-squatted versions → https://github.com/elceef/dnstwist

Creepy – Tool for geolocation and social media footprinting based on shared content → https://github.com/ilektrojohn/creepy

FOCA – Extracts metadata and hidden info from documents for footprinting → https://www.elevenpaths.com/labstools/foca/index.html

ExifTool – Extracts metadata from image, PDF, DOC, and other file types → https://exiftool.org

Twint – Twitter scraper to extract tweets and metadata without needing API keys → https://github.com/twintproject/twint

Google Dorks – Advanced Google search operators for locating sensitive files and pages → https://www.exploit-db.com/google-hacking-database

Onyphe – Cyber threat intelligence engine for IPs, leaks, exposures, and ports → https://www.onyphe.io

MalwareBazaar (abuse.ch) – Malware sample repository for hash-based searches and threat data → https://bazaar.abuse.ch

ThreatFox (abuse.ch) – IOCs feed (IPs, domains, URLs, hashes) related to malware infrastructure → https://threatfox.abuse.ch

URLScan.io – Visual scan of any website for identifying redirects, phishing, or embedded resources → https://urlscan.io

MetaDefender – Multiscanning and sanitization tool for files and URLs → https://metadefender.opswat.com

Pulsedive – IOC enrichment, threat intelligence search engine for domains, IPs, and URLs → https://pulsedive.com

GreyNoise – Detects internet-wide scans and provides context for noisy IPs → https://www.greynoise.io

ThreatMiner – Passive DNS, malware analysis, and IOC enrichment platform → https://www.threatminer.org

Censys – Scan and explore live internet-facing hosts, certs, and services → https://censys.io

RiskIQ Community – Surface web, WHOIS, and passive DNS lookup tool → https://community.riskiq.com

Have I Been Pwned – Check email address for breaches or data leaks → https://haveibeenpwned.com

Spyse (now part of SecurityTrails) – Cybersecurity search engine for IPs, domains, DNS, and certs → https://securitytrails.com

Leak-Lookup – Search for leaked credentials (usernames/emails/passwords) in past breaches → https://leak-lookup.com

SecurityTrails – Real-time asset discovery and threat surface visibility platform → https://securitytrails.com

IntelligenceX – Search engine for archives, leaks, darknet, domains, and emails → https://intelx.io

WhoisXML API – WHOIS, DNS, and IP intelligence data for enrichment and investigations → https://www.whoisxmlapi.com

SpiderFoot – Automated OSINT tool for IPs, emails, domains, and more → https://www.spiderfoot.net

CERT.at Passive DNS – Passive DNS lookup for domains and IPs → https://www.cert.at/pdns

Sherlock – OSINT tool to find usernames across many social media sites → https://github.com/sherlock-project/sherlock

OTX AlienVault Passive DNS – Passive DNS database via OTX for domain/IP history → https://otx.alienvault.com

Recon-ng – Web reconnaissance framework for open-source discovery → https://github.com/lanmaster53/recon-ng

Hunter.io – Finds email addresses and contact info based on domain → https://hunter.io

theHarvester – Collects emails, subdomains, hosts from search engines and public sources → https://github.com/laramies/theHarvester

EmailRep.io – Checks email address reputation and risk factors → https://emailrep.io