Repolode
Submit
stanfrbd

stanfrbd/cyberbro

A self-hosted web app that extracts IoCs from raw text and checks their reputation across many threat intelligence services.

Open-source alternative to:VirusTotal

View on GitHubWebsite
Stars
696
Forks
77
Open issues
35
Last commit
3 days ago

What is it?

Cyberbro takes pasted logs or free text, pulls out indicators of compromise such as IPs, domains, URLs, file hashes and Chrome extension IDs, and runs them through a set of reputation engines. Results from services like VirusTotal, AbuseIPDB, Shodan, ThreatFox and URLscan are gathered into one report that can be filtered and exported to CSV or Excel.

The tool also pivots on observables, using reverse DNS, RDAP/Whois and abuse contact lookups to find related infrastructure. Integrations with endpoint and SIEM-style platforms such as Microsoft Defender for Endpoint, CrowdStrike, MISP, OpenCTI and DFIR IRIS let it check indicators against your own security tools. Many engines are free and need no API key; others are enabled by adding tokens to a .env file.

It runs as a Flask app with Docker Compose, stores analysis history in SQLite, supports proxies, and exposes a small JSON API at /api/ for starting analyses and fetching results, plus an MCP server for use with LLM clients.

Key features

  • 01Extracts IPs, domains, URLs, hashes and Chrome extension IDs from raw text automatically.
  • 02Queries many threat intelligence services in one pass, with multithreaded processing.
  • 03Pivots via reverse DNS, RDAP/Whois and abuse contact lookups.
  • 04Integrates with MDE, CrowdStrike, MISP, OpenCTI and DFIR IRIS.
  • 05Exports results to CSV or Excel and keeps analysis history in SQLite.
  • 06Provides a JSON API and browser extensions for Firefox, Chromium and Edge.

Use cases

  • Triaging suspicious IPs, domains and hashes pulled from incident logs.
  • Quickly enriching indicators during threat hunting or DFIR work.
  • Running a lightweight, self-hosted reputation lookup without a complex platform.
  • Automating IoC checks from scripts or LLM tools through the API and MCP.

Quick start

  1. 1

    Clone the repository

    git clone https://github.com/stanfrbd/cyberbro
  2. 2

    Enter the project folder

    cd cyberbro
  3. 3

    Copy the sample config file to .env

    cp .env.sample .env
  4. 4

    Start the app with Docker, then open http://127.0.0.1:5000

    docker compose up

Things to know

  • Requires Docker or a manual Python setup with a configured .env file.
  • Many engines need API keys, though free engines work without them.
  • Production use requires a reverse proxy and WAF, per the README.

In collections

Security scanners, audits & threat intel tools

Topics

#cyber-threat-intelligence#ioc#security#osint#incident-response#threat-hunting#flask#docker#blueteam#cti

FAQ

What is cyberbro?
A self-hosted web app that extracts IoCs from raw text and checks their reputation across many threat intelligence services. Cyberbro takes pasted logs or free text, pulls out indicators of compromise such as IPs, domains, URLs, file hashes and Chrome extension IDs, and runs them through a set of reputation engines. Results from services like VirusTotal, AbuseIPDB, Shodan, ThreatFox and URLscan are gathered into one report that can be filtered and exported to CSV or Excel.
Is cyberbro free to use? What license does it have?
cyberbro is open source under the MIT license. Check the license terms before using it in commercial products.
Is cyberbro still maintained?
Actively maintained. The last commit to cyberbro was on Oct 19, 2026.
What can I use cyberbro for?
Triaging suspicious IPs, domains and hashes pulled from incident logs. Quickly enriching indicators during threat hunting or DFIR work. Running a lightweight, self-hosted reputation lookup without a complex platform. Automating IoC checks from scripts or LLM tools through the API and MCP.
How do I install cyberbro?
Clone the repository: git clone https://github.com/stanfrbd/cyberbro Enter the project folder: cd cyberbro Copy the sample config file to .env: cp .env.sample .env Start the app with Docker, then open http://127.0.0.1:5000: docker compose up
Where can I get cyberbro?
The source code and installation instructions are on GitHub: https://github.com/stanfrbd/cyberbro

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects