Ahtapot — Cyber Threat Intelligence: IOC & AI Security Analysis

Cyber threat intelligence in your browser: analyze IPs, domains, URLs & hashes with 11 security sources and AI. Free, open source.

Ahtapot is a browser-based cyber threat intelligence tool designed to help security professionals investigate suspicious indicators without interrupting their workflow. Select text on any webpage to detect and analyze IP addresses, domains, URLs, file hashes, CVEs, email addresses and cryptocurrency addresses. Results from supported threat intelligence services appear in a unified side panel, followed by an optional AI-generated assessment. WHAT’S NEW IN VERSION 3.1 • A new built-in national threat feed that requires no API key • Streaming results as each intelligence source responds • Automatic handling of defanged indicators such as hxxps:// and [.] • Updated AI model options with multiple cost tiers • A redesigned interface for faster investigations THREAT INTELLIGENCE ANALYSIS Ahtapot connects directly to multiple security intelligence services to provide: • File and URL reputation • Malware and phishing detection • IP and domain risk assessment • Network ownership and registration details • Internet exposure information • Threat feed matching Each indicator is sent only to services that support its type. This helps reduce unnecessary requests and preserve API usage limits. Two built-in data sources work without configuration. Additional integrations can be enabled by entering your own API keys in the extension settings. AI-ASSISTED VERDICTS Use your preferred supported AI provider to turn raw intelligence results into a clear security assessment. Available analysis levels include: • Summary for quick triage • Analysis for investigation and escalation • Detailed reporting with MITRE ATT&CK context Results can be exported as Markdown or PNG for reports and documentation. SMART IOC DETECTION Ahtapot automatically recognizes: • IPv4 and IPv6 addresses • Domains and URLs • MD5, SHA-1 and SHA-256 file hashes • Email addresses • CVE identifiers • Bitcoin and Ethereum addresses Defanged indicators commonly found in threat reports and security advisories are normalized automatically before analysis. PRIVACY-FIRST ARCHITECTURE • API keys are stored locally in your browser • Keys are sent only to their corresponding services • No Ahtapot account or intermediary backend is required • No user tracking or analytics • Queries use direct HTTPS connections • Open-source and Content Security Policy compliant BUILT FOR SECURITY WORKFLOWS • Analyze selected text using a floating button or context menu • View results as they arrive in a side panel • Review findings by intelligence source • See clear Safe, Suspicious, Malicious and Unknown classifications • Reorder integrations with drag and drop • Reuse recent results with smart caching • Use the interface in English or Turkish GETTING STARTED 1. Install the extension and begin with the built-in data sources 2. Add optional API keys to enable additional intelligence services 3. Add an AI provider key if you want generated assessments 4. Select an indicator on any webpage and click Analyze WHO IT’S FOR Ahtapot is designed for security analysts, incident responders, threat hunters, security researchers, penetration testers, IT administrators and developers investigating suspicious indicators. WHY ARE API KEYS REQUIRED? Ahtapot communicates directly with third-party intelligence and AI services. Using your own API keys removes the need for an intermediary server and gives you control over which services receive your queries. Many supported services offer free usage tiers. OPEN SOURCE Ahtapot is an open-source project developed transparently with community contributions. Website: https://ahtapot.me Source code and documentation: https://github.com/abdullahcicekli/ahtapot ENTERPRISE ALTERNATIVE Organizations that need an enterprise-focused threat intelligence and IOC enrichment workflow can explore Outpost by Binalyze: https://outpost.binalyze.ai Note: Some optional integrations require third-party API keys. Setup instructions are included in the extension.