GitHub Trends
Blue-team, red-team, and dual-use phishing security projects found by the scheduled GitHub scanner. The radar is meant to help defenders, testers, and researchers track useful tooling without turning the feed into a credential-theft kit directory.
RepositoryBlue team tool
TweetFeed collects Indicators of Compromise (IOCs) shared by the infosec community at Twitter. Here you will find malicious URLs, domains, IPs, and SHA256/MD5 hashes. 694 stars.
Read:README previewGitHub project
#blueteam#malware#malware-detection#malware-research#osint#phishing#phishing-attacks#phishing-detection
HTMLBlue team tool
Real-time phishing & scam domain blocklist - 205k+ curated threats, 1M+ community, free API, multiple formats Primary language: HTML. 2,092 stars.
Read:README previewGitHub project
#anti-phishing#blacklist#blocklist#crypto-scam#cybersecurity#dns-blocklist#domains#drainer
RepositoryBlue team tool
oisd blocklist 272 stars.
Read:README previewGitHub project
#adblocking#adblocking-dns#adblocking-list#adblocklist#adblockplus#adguardhome#blocklist#dns
ShellBlue team tool
🐟 PhishTank Blocklist for Pi-hole Primary language: Shell. 13 stars.
Read:README previewGitHub project
#blocklist#hosts#phishing#pihole#pihole-phishtank
ZeekBlue team tool
Zeek-Formatted Threat Intelligence Feeds Primary language: Zeek. 405 stars.
Read:README previewGitHub project
#malware#phishing#threat-intelligence#threatintel#zeek#zeek-ids
PythonRed team tool
Fire-AV is a collection of lists that you can use to block av providers and bad ips Primary language: Python. 24 stars.
Read:README previewGitHub project
#anti-av#firewall#phishing#wordlists
PythonBlue team tool
Advanced Phishing Protection: Suricata rulesets open and free Primary language: Python. 42 stars.
Read:README previewGitHub project
#anti-phishing#antiphishing#detection-engineering#idps#ids#ips#ndr#network-monitoring
DIGITAL Command LanguageBlue team tool
Aggregation of lists of malicious domains (phishing) that can be integrated into FortiGate firewalls and other products. Primary language: DIGITAL Command Language. 120 stars.
Read:README previewGitHub project
#blocklist#blocklists#domains-blacklist#domains-list#fortigate#fortinet#malicious-domains#phishing
RepositoryBlue team tool
Aggregation of lists of malicious IP addresses (C2, malware, phishing), to be blocked in the LAN > WAN direction, integrated into firewalls: FortiGate, Palo Alto, pfSense, IPtables 43 stars.
Read:README previewGitHub project
#blocklist#blocklists#c2#firewall#fortinet#malware#malware-protection#phishing
RepositoryBlue team tool
Pi-hole and AdguardHome Block lists updated every 24Hrs, we aim for less than 0.01% false positive rate, block malware, C&C infrastructure, phishing and banking threats 57 stars.
Read:README previewGitHub project
#adguard-blocklist#adguard-blocklists#adguard-home-blocklist#botnet-blocklist#malware-protection#malware-research#phishing#phishing-detection
PythonBlue team tool
This repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. Contains multiple types such as IP, URL, CVE and Hash. Primary language: Python. 965 stars.
Read:README previewGitHub project
#c2#ioc#iocfeed#malware#misp#phishing#threat-hunting#threat-intelligence
TypeScriptBlue team tool
A 135+ tool DFIR toolkit, a live self-updating threat-intel platform, and a 332-tool MCP server — on one Cloudflare Workers deploy. MIT licensed. Portfolio: pranithjain.qzz.io Primary language: TypeScript. 5 stars.
Read:README previewGitHub project
#blue-team#cloudflare-workers#cti#detection-engineering#dfir#edge-computing#email-security#incident-response
RepositoryBlue team tool
A public, research-focused dataset of expired, and recently dropped domains curated for cybersecurity analysis, brand monitoring, threat intelligence, and market research. 14 stars.
Read:README previewGitHub project
#daily-dropped-domains#daily-expired-domains#domain-intelligence#drop-lists#dropped-domains#expired-domains#expiring-domains#osint
YAMLBlue team tool
Sublime rules for email attack detection, prevention, and threat hunting. Primary language: YAML. 380 stars.
Read:README previewGitHub project
#email-security#phishing#threat-hunting
TextBlue team tool
DNS-Blocklists: For a better internet - keep the internet clean! Primary language: Text. 27,809 stars.
Read:README previewGitHub project
#adblock#adguard#ads#blacklist#blocklist#coins#dns#domains
Adblock Filter ListNeeds classification review
Wersja hosts, PiHole, dnsmasq, domenowa (Forti Guard) filtrów KAD Primary language: Adblock Filter List. 63 stars.
Read:README previewGitHub project
#kad#kadhole#malware#phishing#phishing-sites#pi-hole#polish#polskie
Adblock Filter ListNeeds classification review
Filtry do uBlocka Origin i AdGuarda, chroniące przed różnymi zagrożeniami w polskiej sieci, takimi jak wirusy, fałszywe sklepy i subskrypcje SMS. Primary language: Adblock Filter List. 67 stars.
Read:README previewGitHub project
#adguard#blocker#filter-lists#filterlist#filters#filtr#filtry#kad
JavaScriptBlue team tool
One extension. Every defence. - the all-in-one privacy, security & anti-scam extension for Chromium browsers (MV3). 108 on-device protections: ad & tracker blocking, anti-fingerprinting, phishing/scam & credential-theft defence, cookie-wall lifting, download scanning, IP-leak protection, plus YouTube & Twitch tools. No account, no telemetry. GPLv3. Primary language: JavaScript. 21 stars.
Read:README previewGitHub project
#adblock#adblocker#anti-fingerprinting#anti-phishing#anti-scam#anti-tracking#browser-extension#chrome-extension
RepositoryDual-use project
A fresh feed of crypto phishing and crypto scam websites. Automatically updated daily/frequently. 75 stars.
Read:README previewGitHub project
#blacklist#blocklist#cryptocurrency#osint#phishing#phishing-detection#phishing-page#phishing-sites
GoDual-use project
A modern GoPhish fork with improved tracking accuracy and smarter detection. Primary language: Go. 94 stars.
PythonBlue team tool
A collection of unified blocklists designed to provide complete filtering capabilities for different online threats. Curated from multiple sources (click SOURCES.md to view), these blocklists offer a robust solution for blocking ads, malware, trackers, and other unwanted content. Primary language: Python. 129 stars.
Read:README previewGitHub project
#adblock#adguard#adguard-home#ads#blocklist#crypto#dnsmasq#domains
JavaScriptBlue team tool
Canadian threat feeds updated every 12 hours. Primary language: JavaScript. 23 stars.
Read:README previewGitHub project
#blocklist#canada#phishing#threat-intelligence
PythonDual-use project
A curated, evidence-led guide to AI for security and security for AI. Defensive research, agent safety, MCP security, AI red-teaming and evaluation, authorized testing workflows, and detection engineering. Primary language: Python. 45 stars.
Read:README previewGitHub project
#ai-hacking#ai-red-teaming#ai-security#artificial-intelligence#autonomous-agents#awesome#botnet#cybersecurity
TypeScriptRed team tool
Tyto-PhishShield is an AI-powered phishing awareness and simulation platform. Tyto-PhishShield is an enterprise-grade Human Risk Management (HRM) platform. Primary language: TypeScript. 5 stars.
Read:README previewGitHub project
#ai#analytics#email-generation#llm#phishing#phishing-education#phishing-simulation
TypeScriptDual-use project
x402 risk-check provider: signed pre-payment verdicts — OFAC, phishing feeds, transaction simulation, drainer-kit code, and our own EIP-7702 kit watch (poisoners, sweepers). $0.001 per check with prepaid credits; per call via x402 from $0.0035. Primary language: TypeScript. 12 stars.
Read:README previewGitHub project
#ai-agents#attestation#base#cloudflare-workers#drainer-detection#ethereum#guardrails#jev
RepositoryBlue team tool
Newly Registered Domains (NRD) lists generated from WhoisDS.com free database — daily domain lists for security and threat analysis. 55 stars.
Read:README previewGitHub project
#bloatware#botnet#malware#newly-registered-domains#nrd#phishing#scam#spyware
HTMLBlue team tool
ShortDot SA zone abuse evidence — 6,242,647 domains across .icu, .bond, .cyou, .sbs, .cfd, .buzz, .qpon. 237,894 classified IOC (153,775 HIGH), 6,169 feed/intel confirmed. Daily updated IOC feeds, STIX 2.1 bundle, SIEM CSV. Primary language: HTML. 129 stars.
Read:README previewGitHub project
#cybersecurity#domain-abuse#icann#ioc#osint#phishing#shortdot#stix2
PythonNeeds classification review
Open-source email analytics platform to identify spam, phishing, and malicious content. Primary language: Python. 29 stars.
Read:README previewGitHub project
#cybersecurity#cybersecurity-tools#email#email-phishing#email-verification#threath-analysis
ShellBlue team tool
My personalized Hosts file collection of various sources, cleaned and optimized specially for pDNSf Primary language: Shell. 31 stars.
Read:README previewGitHub project
#ad-block#ad-blocker#adblock#ads#blocklist#collection#filterlist#hosts
Adblock Filter ListNeeds classification review
The enhanced and optimized DNS filter for AdGuard Home🚧 Primary language: Adblock Filter List. 17 stars.
Read:README previewGitHub project
#adblock#adguard#ads#advertisement#advertising#adware#banners#blocking
DartBlue team tool
100% on-device, air-gapped cyber defense & scam detection suite for Android. Real-time phishing radar, biometric hardware vault (AES-256), OS exploit audit, and rapid 1930 incident response — zero cloud, zero tracking. Built by Umar Farooque. Primary language: Dart. 10 stars.
Read:README previewGitHub project
#air-gapped#android#anti-phishing#cybersecurity#dart#flutter#fraud-detection#hardware-vault
HTMLBlue team tool
Complete zone scan of NICENIC INTERNATIONAL GROUP CO., LIMITED (IANA #3765, China) — 376,687 domains tracked. 82,576 classified IOC (35,902 HIGH): phishing, carding, crypto drainers, malware, unlicensed gambling. IOC feeds, SIEM CSV, operator clusters. Evidence package for ICANN RAA complaint Primary language: HTML. 123 stars.
Read:README previewGitHub project
#icann#ioc#nicenic#phishdestroy#phishing#registrar-abuse#threat-intelligence
HTMLBlue team tool
NameSilo (IANA #1479) registrar abuse investigation — 5,281,151 domains scanned, 204,460 classified IOC (122,119 HIGH), largely behind NameSilo's own PrivacyGuardian WHOIS shield. Filed with ICANN Mar 2026. Daily updated IOC feeds, SIEM CSV, operator clusters. Primary language: HTML. 151 stars.
Read:README previewGitHub project
#abuse-investigation#cybersecurity#domain-intelligence#icann#monero-drainer#namesilo#phishing#registrar-abuse
HTMLBlue team tool
Phase II evidence package: complete-zone scan of ICANN registrar #4318 Trustname.com / Fewmoretaps OÜ — 15,040 domains tracked, 4,276 classified IOC (3,293 HIGH). Daily updated IOC feeds, SIEM CSV, operator clusters. Primary language: HTML. 108 stars.
Read:README previewGitHub project
#blocklist#bulletproof#fewmoretaps#icann#icann-4318#ioc#phishdestroy#phishing
RepositoryBlue team tool
To be used with tools like GoBuster & DirBuster but these lists are specifically tailored and designed for scanning phishing <>< landing pages and other malicious or sketch af financial/crypto fraud websites. 93 stars.
Read:README previewGitHub project
#brute-force#brute-force-search#cti#cyber-threat-intelligence#fuzzing#fuzzing-tool#fuzzing-wordlist#phishing
RepositoryBlue team tool
Redacted real-world spam, scam, and phishing email samples for security research. 6 stars.
Read:README previewGitHub project
#awareness-training#datasets#email-security#eml-files#phishing#phishing-samples#scam#security-research
RepositoryBlue team tool
Pre-built, deduplicated Pi-hole blocklists merged from curated upstream sources and community reports: a master list plus advertising, tracking, malware and phishing, suspicious, and NSFW categories. Rebuilt weekly. 542 stars.
Read:README previewGitHub project
#adblock#adguard#blocklist#cybersecurity#dns#dns-blocking#hosts#hosts-file
RepositoryBlue team tool
Custom SpamAssassin rules I and others have made and contributed with - To mitigate spam mails and phishing mails now also with cool Phishtank rules 60 stars.
Read:README previewGitHub project
#cf#phishing#phishtank#rules#spam-detection#spam-filtering#spamassassin
PythonBlue team tool
Limnex URL Intelligence Engine: a generative model of URLs, trained from scratch, for defensive phishing research. Primary language: Python. 5 stars.
Read:README previewGitHub project
#phishing-detection#security-research#synthetic-data#transformer#url
JavaScriptBlue team tool
Hermes Secure Email Gateway is a Free Open Source Secure Email Gateway and Email Server Primary language: JavaScript. 141 stars.
Read:README previewGitHub project
#anti-phishing#anti-spam#arc#dkim#dmarc#docker-compose#email-encryption#email-gateway
RepositoryNeeds classification review
A filter configuration for the Simply Filter SMS app on iOS 4 stars.
Read:README previewGitHub project
#ios#privacy#regex#simply-filter-sms#smishing#sms-filter#spam-filter
PythonBlue team tool
Python API for Phishtank Lookup Primary language: Python. 5 stars.
Read:README previewGitHub project
#information-extraction#osint#phishing#phishing-sites#phishtank#phishtank-api
PythonBlue team tool
Simple web API using the hourly dump from Phishtank Primary language: Python. 12 stars.
Read:README previewGitHub project
#information-security#osint#phishing#phishing-detection#phishtank#phishtank-api
JavaScriptDual-use project
Automated Social Media Phishing Tool. Automated tool that allow us to hack accounts with 2FA Bypass. Primary language: JavaScript. 54 stars.
Read:README previewGitHub project
#ethical-hacking#ethical-hacking-tools#hacking-tool#javascript#madhan#madhan-hacker#madhanmaaz#nodejs
RepositoryBlue team tool
Archive of phishing kits captured from suspicious domains detected by phishunt.io, with a sha256 manifest 286 stars.
Read:README previewGitHub project
#malware#osint#phishing#phishing-attacks#phishing-detection#phishing-kit#phishing-sites#scam
GoBlue team tool
URL / IP / Email defanging with Golang. Make IoC harmless. Primary language: Go. 24 stars.
Read:README previewGitHub project
#defang#defanging#defense#defensive-security#email-security#go#golang#golang-module
RepositoryBlue team tool
Threat intelligence research reports (PDF) on APT groups, ransomware, malware and phishing from the Brandefense research team. 23 stars.
Read:README previewGitHub project
#apt#cti#cyber-threat-intelligence#cybersecurity#dfir#hermeticwiper#incident-response#infosec
RepositoryBlue team tool
Indicators of compromise (IOCs), YARA and Sigma rules from Brandefense threat research on APT groups, ransomware and infostealers. 25 stars.
Read:README previewGitHub project
#apt#apt28#cti#detection-engineering#dfir#indicators-of-compromise#infosec#infostealer
GoBlue team tool
Phishing detection engine with layered analysis and explainable verdicts. phishing detection phishing detection Primary language: Go. 110 stars.
Read:README previewGitHub project
#domain-analysis#golang#link-scanner#phishing#phishing-detection#python#security-tools#threat-intelligence
GoNeeds classification review
Give a man a 0day and he'll have access for a day, teach a man to phish and he'll have access for life. Primary language: Go. 5 stars.
ShellBlue team tool
A free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing. Gain visibility and control, hunt for advanced threats, collaborate with the community, and write detections-as-code. Primary language: Shell. 277 stars.
Read:README previewGitHub project
#detection-rules#email-security#phishing#phishing-detection#security#security-tools
PythonBlue team tool
Machine-readable .txt blocklist of scam URLs and IP Addresses from the Global Anti Scam Organization (https://www.globalantiscam.org) website, updated once a day. Primary language: Python. 34 stars.
Read:README previewGitHub project
#blocklist#dnsbl#ip#ipv4#osint#pfblockerng#phishing#pihole
JavaScriptBlue team tool
URL / IP / Email defanging with Javascript. Make IoC harmless. Primary language: JavaScript. 33 stars.
Read:README previewGitHub project
#cti#defang#defanging#email#email-security#emailjs#evasion-attack#ioc
GoDual-use project
Actively maintained, security-hardened fork of Gophish — the open-source phishing toolkit Primary language: Go. 14 stars.
Read:README previewGitHub project
#awareness#cybersecurity#email-security#golang#gophish#penetration-test#phishing#phishing-simulation
AppleScriptBlue team tool
Spam filter for Apple's Mail.app on macOS Primary language: AppleScript. 34 stars.
Read:README previewGitHub project
#apple-mail#applescript#blacklist#email#extension#javascript#js#junkmail
PythonBlue team tool
Jev (TypeSafe) vs Claude Haiku 4.5 on 2,000 phishing emails: accuracy, calibration, latency, cost. Reproducible benchmark by Anisse Lebadi. Primary language: Python. 10 stars.
Read:README previewGitHub project
#benchmark#calibration#jev#llm-evaluation#phishing-detection#typesafe
JavaScriptBlue team tool
🎁 Securing your crypto journey, one block at a time. Primary language: JavaScript. 26 stars.
Read:README previewGitHub project
#abuse-detection#adblock#adblocker#crypto-miner#cryptocurrencies#cryptocurrency#cryptojacking#filterlist
JavaScriptBlue team tool
Watcher - Open Source AI-powered Cyber Threat Intelligence & Hunting Platform. Developed with Django & React JS. Primary language: JavaScript. 1,434 stars.
Read:README previewGitHub project
#ai#ai-threat-intelligence#certificate-transparency#certstream#cyber-ai#cybersecurity#django#huggingface
PythonBlue team tool
Zero-trust link forensics & neural phishing detection in a tactical monochrome UI. Primary language: Python. 10 stars.
JavaScriptBlue team tool
A local, privacy-first Chrome extension that detects phishing sites in real time using heuristics + a locally-trained ML model. No cloud, no external APIs. Primary language: JavaScript. 6 stars.
Read:README previewGitHub project
#browser-extension#cybersecurity#javascript#machine-learning#phishing-detection#python#source-code