cybergordon.com

What It Is

CyberGordon is a personal-project-style cybersecurity reputation checking tool, positioned to help users with cyber threat hunting. It can quickly analyze observables such as IPv4, IPv6, URLs, domains/FQDNs, MD5, SHA-1, SHA-256, and email addresses, then cross-check the results against 30+ open security databases or engines.

Core Capabilities

In terms of protection category, it is not a traditional firewall, EDR, or WAF. Instead, it is a threat intelligence aggregation and IOC reputation verification tool. Its key feature is passive checking: it only queries existing records in open security databases and does not launch new scans or requests against the target. However, the source text notes that live DNS lookup may be considered an exception. Results are presented as summary reports; some engines mark suspicious or malicious risks in orange or red, and reports can be exported as Excel, PDF, or CSV files, making them suitable for retaining analysis records.

Deployment, Management, and Integration

CyberGordon is provided as an online web service. Users can submit multiple types of observables at once through a web form, or query a single object via HTTP GET /request/_obs_. Programmatic queries are tolerated at a rate of 10 analyses per minute; exceeding that or abusing the service may result in blocking. The backend uses Python 3 and AWS Lambda, with data hosted in the AWS US region. Results can be shared via URL for 7 days, after which requests, results, and related copies are deleted. Data in transit uses TLS v1.3, while data at rest is encrypted with AES-256.

Pricing and Support

The source text does not provide commercial pricing, subscriptions, enterprise SLAs, or formal support channels. It only mentions donations via Buy me a coffee. Contact channels are mainly X or Mastodon, which makes it closer to a community/personal-tool support model. As a result, it offers strong value for money, but should not be used as the sole intelligence source for enterprise-critical workflows.

Pros, Cons, and Best-Fit Users

Its strengths include ease of use, coverage of common IOC types, multi-source aggregation, export support, private-by-default handling, and deletion after 7 days. Limitations include a relatively low request rate, dependence on third-party engine quotas, and the possibility that some engines may change temporarily. It also blocks proxies, VPNs, Tor, bots, and suspicious sources. CyberGordon is better suited for security analysts, SOC operators, incident response teams, and individual researchers who need quick initial triage. Organizations requiring large-scale automated queries or strict compliance/SLA guarantees should proceed with caution.

Access from China

The source text does not provide information on access from mainland China, payment options, or local compliance. Since it is hosted on AWS in the US and uses hCaptcha for anti-abuse protection, real-world access stability is unknown. If access is limited, users may consider self-hosting Cyberbro, or combining alternative intelligence sources such as VirusTotal, IBM X-Force, GreyNoise, and AbuseIPDB.