Topics / #threat-intelligence

Threat-intelligence projects on GitHub

Resources and platforms for collecting and analyzing indicators of cyber threats.

As of October 18, 2026, the most-starred Threat-intelligence projects on GitHub are Awesome-Hacking (122.9K stars), Anthropic-Cybersecurity-Skills (34.6K stars) and awesome-osint (30.3K stars). GitHub.Locker tracks 22 Threat-intelligence repositories with 409.4K stars combined. The fastest-growing on October 17 was Awesome-Hacking, with +106 stars in a day.

22Projects

409.4KStars in total

+392Stars in a day

Browse in the catalog →github.com/topics/threat-intelligence ↗

Hot right now

Most stars gained in a day · Oct 17

+106

Awesome-Hacking

Hack-with-Github/Awesome-Hacking · ★ 122.9K

A massive index that links out to dozens of other awesome-lists covering nearly every security domain: android security, bug bounty, fuzzing, malware analysis, OSINT, reverse engineering, web hacking, and more.

+44

dns-blocklists

hagezi/dns-blocklists · ★ 27.5K

A set of DNS blocklists that block ads, trackers, telemetry, phishing, malware, scams and other junk domains network-wide. They work for any region and with every common DNS server, ad blocker, and content blocker.

+43

Anthropic-Cybersecurity-Skills

mukul975/Anthropic-Cybersecurity-Skills · ★ 34.6K

An open-source library of 818 production-grade cybersecurity skills for AI agents, covering 34 security domains and mapped to six frameworks including MITRE ATT&CK and NIST CSF 2.0.

+39

flowsint

reconurge/flowsint · ★ 9.8K

Flowsint is an open-source, graph-based OSINT investigation tool that lets analysts explore relationships between people, domains, IPs, organizations and more through a visual graph interface with automated enrichers.

The all-time top

22 projects · by stars

#1 · Hack-with-Github/Awesome-Hacking
Awesome-Hacking
A massive index that links out to dozens of other awesome-lists covering nearly every security domain: android security, bug bounty, fuzzing, malware analysis, OSINT, reverse engineering, web hacking, and more.
122.9K
#2 · mukul975/Anthropic-Cybersecurity-Skills
Anthropic-Cybersecurity-Skills
An open-source library of 818 production-grade cybersecurity skills for AI agents, covering 34 security domains and mapped to six frameworks including MITRE ATT&CK and NIST CSF 2.0.
34.6K
#3 · jivoi/awesome-osint
awesome-osint
This is a curated 'awesome list' of hundreds of free and paid OSINT (open source intelligence) tools and resources, organized into categories like general search, Google dorks, data breach lookup, social media, threat actors, and dark web.
30.3K

4
dns-blocklists
27.5Khagezi/dns-blocklists · Text
A set of DNS blocklists that block ads, trackers, telemetry, phishing, malware, scams and other junk domains network-wide. They work for any region and with every common DNS server, ad blocker, and content blocker.
5
spiderfoot
23.6Ksmicallef/spiderfoot · Python
Open source OSINT automation — it collects intelligence on a target for threat intel and attack surface mapping, whether you are doing red team recon or checking what your organisation has exposed.
6
theHarvester
18Klaramies/theHarvester · Python
An open-source OSINT tool that gathers emails, subdomains and names about a domain or organization from public sources: search engines, certificate transparency logs, DNS datasets, code repositories and threat-intel platforms, normalizing hostnames, emails, IPs, URLs, ASNs, people and breach names.
7
wazuh
17.3Kwazuh/wazuh · C++
Wazuh is a free, open source security platform (XDR and SIEM) for threat prevention, detection and response across on-premises, virtualized, containerized and cloud workloads.
8
mvt
15.4Kmvt-project/mvt · Python
MVT (Mobile Verification Toolkit) is a collection of forensic utilities that help gather and analyze traces on Android and iOS devices to identify a potential compromise, originally built by Amnesty International's Security Lab during the Pegasus Project.
9
crowdsec
15.2Kcrowdsecurity/crowdsec · Go
CrowdSec is an open-source IDS/IPS and WAF that detects malicious behavior by analyzing logs and HTTP requests, blocks bad actors locally, and shares anonymized attack data with a crowdsourced network to build a real-time community blocklist.
10
awesome-malware-analysis
14.3Krshipp/awesome-malware-analysis
A curated 'awesome list' of malware analysis tools and resources, covering sample collection, sandboxes, detection tools, threat intelligence feeds, reverse engineering, and forensics.
11
OSINT-Framework
12.3Klockfale/OSINT-Framework · JavaScript
OSINT Framework is a curated, browsable index of free OSINT (open-source intelligence) tools and resources, organized into a clickable category tree so you can find the right tool for a given task.
12
awesome-hacker-search-engines
11.3Kedoardottt/awesome-hacker-search-engines · Shell
A curated list of search engines useful for penetration testing, vulnerability assessment, red/blue team operations, bug bounty hunting, and general OSINT work.
13
sigma
11.3KSigmaHQ/sigma · Python
Sigma is a generic, open signature format for describing detection patterns in log events, and this repository is the main collection of over 3000 community-written Sigma detection rules for SIEM systems.
14
awesome-threat-intelligence
10.7Khslatman/awesome-threat-intelligence
A curated catalog of threat intelligence resources — feeds, tools, frameworks, standards and research for tracking online threats. It is a pointer list on GitHub, not software you install.
15
bbot
10.7Kblacklanternsecurity/bbot · Python
BBOT is a recursive internet scanner for hackers — it automates recon, bug bounty work and attack surface management (ASM), inspired by Spiderfoot.
16
awesome-honeypots
10.6Kparalax/awesome-honeypots · Python
A curated, categorized list of honeypot software and related tools used by security researchers to deceive attackers, log their behavior, and study exploitation attempts.
17
flowsint
9.8Kreconurge/flowsint · TypeScript
Flowsint is an open-source, graph-based OSINT investigation tool that lets analysts explore relationships between people, domains, IPs, organizations and more through a visual graph interface with automated enrichers.
18
fresh-start
6.2Knirholas/fresh-start
This is the repository formerly known as nirholas/claude-code, the most widely forked mirror of the Claude Code source leak from 31 March 2026. The leaked source itself was stripped out after Anthropic's DMCA notice, which has not been retracted, so the repo now just explains what happened.
19
user-scanner
5.4Kkaifcodec/user-scanner · Python
User Scanner is an OSINT (open-source intelligence) CLI tool that takes an email address or username and scans it across 2720+ platforms (210+ email vectors, 2510+ username vectors) to map digital footprints, scrape profile metadata, and surface linked accounts.
20
Offensive-Security-AI-Models
696JoasASantos/Offensive-Security-AI-Models
A curated list of open-weight, uncensored language models fine-tuned for offensive-security tasks like penetration testing, red teaming, and security research. The README documents over 20 models sourced from HuggingFace model cards as of September 2026.
21
blocklist-abuseipdb
600borestad/blocklist-abuseipdb · Shell
A continuously updated set of IP blocklists aggregating AbuseIPDB's worst IPv4 and IPv6 offenders (~99% confidence), plus other free public threat sources, meant to be loaded straight into a firewall to block malicious traffic.
22
Stuxnet
588Sadpainy/Stuxnet · C
This is a reconstructed source code of Stuxnet, the famous 2010 worm that sabotaged Siemens industrial control systems, rebuilt by the author from reverse-engineering research for educational and malware-analysis purposes.