Ahtapot — Cyber Threat Intelligence: IOC & AI Security Analysis

Cyber threat intelligence in your browser: analyze IPs, domains, URLs & hashes with 11 security sources and AI. Free, open source.

Ahtapot is a browser extension that helps you investigate suspicious indicators without leaving the page you are reading. Select text on any webpage and Ahtapot will detect indicators such as IP addresses, domains, URLs, file hashes, CVE identifiers, email addresses and cryptocurrency addresses. Results from supported services appear in a side panel, followed by an optional AI-generated assessment. WHAT'S NEW IN VERSION 3.1 • A built-in national threat feed that works without an API key • Results appear as each service responds • Defanged indicators like hxxps:// and [.] are corrected automatically • Updated AI model options at different cost levels • A redesigned, faster interface HOW IT WORKS Ahtapot sends each indicator only to the services that support its type. This avoids unnecessary requests and helps you stay within your API usage limits. Depending on the services you enable, you can see reputation scores, malware and phishing detections, network ownership and registration details, and internet exposure information. Two built-in data sources work right after installation. You can enable more services by adding your own API keys in the settings. AI ASSESSMENTS Connect a supported AI provider to turn raw results into a readable assessment. You can choose a short summary for quick triage, a fuller analysis for escalation, or a detailed report that includes MITRE ATT&CK context. Results can be exported as Markdown or PNG. PRIVACY API keys are stored locally in your browser and are sent only to the service they belong to. There is no Ahtapot account, no intermediary server, and no tracking or analytics. All queries use direct HTTPS connections. The project is open source and follows Content Security Policy rules. FEATURES • Analyze selected text with a floating button or the right-click menu • Review findings grouped by source • Safe, Suspicious, Malicious and Unknown labels • Reorder services with drag and drop • Caching for recently checked indicators • Interface in English and Turkish GETTING STARTED 1. Install the extension and start with the built-in sources 2. Optionally add API keys for more services 3. Add an AI provider key if you want AI assessments 4. Select an indicator on any webpage and click Analyze WHY ARE API KEYS REQUIRED? Ahtapot communicates directly with third-party services. This means no intermediary server is needed and you decide which services receive your queries. Many of these services offer free usage options. OPEN SOURCE Website: https://ahtapot.me Source code and documentation: https://github.com/abdullahcicekli/ahtapot ENTERPRISE ALTERNATIVE Organizations that need an enterprise-scale threat intelligence and IOC enrichment workflow can explore Outpost by Binalyze: https://outpost.binalyze.ai Note: Some optional integrations require third-party API keys. Setup instructions are included in the extension.