How do I check whether an IP, domain, or file hash is malicious? Query the indicator across independent feeds rather than trusting one verdict. This page links 53 free sources spanning malware sandboxes, IOC databases, vulnerability registries, phishing detection, botnet and C2 tracking, sanctions lists, live threat maps and threat-actor profiles: VirusTotal alone scans against 70+ antivirus engines, and the NIST National Vulnerability Database catalogs over 240,000 CVEs with CVSS severity scores. The built-in feed aggregator checks one IP, domain or hash against 10+ live blocklists at once and returns a composite score showing which feeds flag it.
How to use this page in 30 seconds
- Got an IP, domain or file hash? Paste it into the Threat Feed Aggregator above. It queries 10+ live blocklists at once and returns one composite score with the feeds that flagged it — that is the part that runs here, not a link.
- Need depth? Pick the category that matches your question — malware analysis, IOC databases, CVEs, phishing, botnet/C2, sanctions, threat maps, threat actors — and open the sources in that row. Each link is the platform’s own search, pre-filled where the site allows it.
- Working a CVE? Go straight to the vulnerabilities row: NIST NVD for the record and CVSS score, Exploit-DB and the CISA KEV list for whether it is being exploited.
- Flagged a domain? Pivot to its registration data (creation date, registrar, name servers) to find related infrastructure: how to pivot from a flagged domain.
To be clear about what this is: the aggregator and dashboard run in your browser; everything else is a curated, maintained index of other people’s free tools. It is a starting point for an investigation, not a threat-intelligence platform — no ingestion, scoring or correlation.
How Do You Use Threat Intelligence Platforms for Cybersecurity?
Max Intel's Threat Intelligence tool provides access to 25+ cybersecurity platforms supporting the indicator lookup workflow described in the MITRE ATT&CK framework and NIST SP 800-150. Enter a file hash, IP, domain, URL, or CVE to query malware sandboxes, IOC databases, and vulnerability registries.
Malware Analysis
VirusTotal is the most comprehensive multi-scanner tool, checking files and URLs against 70+ antivirus engines. According to VirusTotal's 2024 transparency report, the platform processes over 2 million unique file submissions per day. Hybrid Analysis and Any.Run provide interactive sandbox analysis where you can observe malware behavior in a safe environment. Joe Sandbox and Triage offer additional sandboxing capabilities. MalwareBazaar and Malshare maintain databases of known malware samples for research purposes.
IOC Search & Correlation
Indicators of compromise (IOCs) — defined by NIST SP 800-53 as observable artifacts that indicate a security incident — can be searched across multiple platforms simultaneously. AlienVault OTX provides community-contributed threat intelligence. ThreatMiner correlates IOCs across data sources. ThreatFox tracks malware-associated indicators. Maltiverse aggregates threat data from multiple feeds. GreyNoise distinguishes targeted attacks from internet-wide scanning noise.
Where do you look up a CVE?
CVE lookup is essential for understanding software vulnerabilities. The NIST National Vulnerability Database (NVD) is the authoritative source, cataloging over 240,000 CVEs with CVSS severity scores. CVE Details provides searchable vulnerability data with statistics. Exploit-DB maintains a database of publicly available exploits linked to CVEs.
How do you pivot from a flagged domain to related infrastructure?
IOC feeds such as ThreatFox and OTX tell you a domain is bad, but rarely who registered it or when. Registration data is often the quickest next step. Domains created on the same day, through the same registrar or on the same name servers can point to one operator; confirm with other evidence before you link them.
Check one domain with our free RDAP Lookup (creation and expiry dates, registrar, name servers). See older records with WHOIS & Contact History, and map related hosts with Domain Recon. To score a long IOC list, a bulk WHOIS API can add domain age to every row. WhoisFreaks is one; its homepage offers 500 free credits after signup WhoisFreaks (read 16 Oct 2026). Privacy-protected records and large shared registrars are weak signals on their own.
How do you research a threat actor or APT group?
Start with MITRE ATT&CK's Groups list, then cross-check names in a second encyclopedia. Vendors give the same group different names, so aliases are the first thing to collect.
- Threat Group Cards from Thailand's Electronic Transactions Development Agency (ETDA) is a public threat-actor encyclopedia you can browse and search. It lists roughly 300 groups, operations and sub-groups ETDA (read 16 Oct 2026).
- APTmap, by Andrea Cristaldi, maps groups by country with charts, a network graph and their malware. It draws on MISP, MITRE, ETDA and vx-underground and is licensed CC BY 4.0. It warns that it "is not a reliable source" because most attributions rest on a single incident analysis APTmap (read 16 Oct 2026). Use it to find leads, then read the original reports.
- Threat Actor Usernames, by CTI Updates, searches 3,317,987 records (2,983,348 unique usernames) to show which forums a handle has used Threat Actor Usernames (read 16 Oct 2026). It does not say where its data comes from, so treat a hit as a lead. Then run the handle through our username search.
- For state influence operations, ISD's Authoritarian Interference Tracker catalogues publicly documented cyber, information, political and economic operations by Russia, China and Iran in Europe and North America. Data runs from 2022, with earlier years being backfilled, and filtered results download as CSV or XLSX ISD (read 16 Oct 2026).
Attribution is a claim, not a fact. Before you name a country or group, note who made the attribution and what evidence they published.
Threat Intelligence — Frequently Asked Questions
How do I check an IP’s reputation for free?
Enter an IP or indicator to check it against threat-intelligence feeds and reputation sources at once, with a live dashboard of active threats. Free situational awareness for defenders and investigators.
How can I check if a file is malware?
Max Intel's Threat Intel tool links to VirusTotal (which scans files against 70+ antivirus engines), Hybrid Analysis, Any.Run, Joe Sandbox, and Triage for dynamic malware analysis. Upload a file hash (MD5, SHA1, or SHA256) to these services to check if it's been flagged as malicious. MalwareBazaar and Malshare provide access to known malware samples for research.
How do I look up a CVE vulnerability?
Max Intel links to the NIST National Vulnerability Database (NVD), CVE Details, CVE MITRE, and Exploit-DB. Enter a CVE identifier (e.g., CVE-2024-1234) to find vulnerability descriptions, severity scores (CVSS), affected software, and available exploits. These are the authoritative sources for vulnerability information.
What are indicators of compromise (IOCs)?
Indicators of compromise are pieces of forensic data that identify potentially malicious activity — including file hashes, IP addresses, domain names, URLs, email addresses, and registry keys. Max Intel links to IOC search platforms including AlienVault OTX, ThreatMiner, ThreatFox, Maltiverse, and GreyNoise for searching and correlating IOCs.
Can I analyze a suspicious URL for free?
Yes, Max Intel links to VirusTotal, URLScan.io, and PhishTank for URL analysis. VirusTotal checks URLs against 70+ security engines. URLScan.io provides visual page screenshots and network request analysis. PhishTank is a community-driven database of known phishing sites.
Is threat intelligence useful for non-security professionals?
Yes, basic threat intelligence tools are useful for anyone concerned about cybersecurity. VirusTotal can check suspicious files and URLs. CVE databases help you understand if software you use has known vulnerabilities. AbuseIPDB can check if an IP sending you emails or connecting to your network has been reported for abuse.