FORGE is a community-first analyst toolkit for quick triage, transformation, and investigation prep. Use it to inspect headers, extract indicators, generate hashes, decode payloads, test patterns, and stay oriented with a compact security watch board.
A clean situational dashboard for defenders: global signal view, rotating attacker feed, and high-priority vulnerability watchlist. It gives the page a living command-center feel while keeping the experience focused and practical.
Practical utilities for quick triage and investigation prep — extract indicators, check reputation, explain suspicious logs, and transform artifacts, all in the tabs below.
A forge takes raw material — unrefined, sometimes genuinely dangerous — and turns it into something useful through heat, pressure, and deliberate shaping. That's the actual daily work of a SOC analyst: raw logs, raw indicators, raw alerts, turned into something you can act on.
The name isn't decoration. It's the job, described plainly.
Paste full raw headers. FORGE unfolds multiline headers, walks the Received chain chronologically, skips private/loopback IPs, and calls out the largest delivery delay.
Extract useful indicators from logs, tickets, alerts, malware notes, or copied incident chat text. Files and fetched URLs are processed locally in the browser wherever possible.
Need a reputation check on an extracted IP, URL, or hash? Head to the tab.
Generate MD5 for text and SHA family hashes for text or files. SHA uses the browser WebCrypto API.
Looking to check a hash's reputation against VirusTotal instead of just generating one? Head to the tab.
Look up hash, IP, and URL reputation against VirusTotal in one place. Results are cached at the edge for an hour to stay within VirusTotal's free-tier quota — use Refresh on any single result if you need the latest data.
Paste any mix of MD5/SHA1/SHA256 hashes, IPv4 addresses, domains, and URLs (one per line, or jumbled together) — FORGE detects each indicator's type automatically and checks it against VirusTotal. Defanged formats like 27[.]207[.]73[.]215, evil[.]com, and hxxps:// are parsed automatically. Paced to respect the shared free-tier rate limit (~4 lookups/minute across all FORGE visitors, regardless of indicator type).
Drag this button to your browser's bookmarks bar. Then, on any page, select an IP / hash / domain / URL and click it to open that indicator straight in FORGE.
🔎 Check on FORGEPaste or upload a large list of public IPv4 addresses (thousands are fine) to enrich each with geolocation and network ownership in one pass — then export a single consolidated CSV. Defanged formats like 27[.]207[.]73[.]215 are handled. Built for bulk enrichment; this is geolocation/ASN data, not reputation (for malicious/clean verdicts use the reputation lookup above, which is rate-limited).
Paste a raw log line, SIEM alert, command line, or script snippet and get a plain-English explanation of what it does, whether it looks suspicious, and what to check next. Runs on Cloudflare Workers AI — your input is processed by the model but never stored by FORGE.
AI output can be wrong — treat it as a starting point for triage, not a verdict. Limited to one entry (max 4,000 characters) per request; usage is shared across all FORGE visitors.
Decode or encode Base64, URL encoding, hex, and JWT payloads without sending data outside the browser.
Output will appear here.
Quick IPv4 CIDR math for analysts reviewing firewall logs, allowlists, alerts, or cloud network ranges.
Build and test log patterns quickly. Matches are shown with index, value, and captured groups.
Everything announced so far is live in the toolkit above. Join the launch list and you'll get one short email when the next analyst module ships — nothing else.
Join the FORGE launch list for the next set of security intelligence tools.
FORGE is built as a free community toolkit by Ameya Saathye — no ads, no accounts, no paywall.
What your support directly funds: the domain and infrastructure, threat-intel API quota (VirusTotal, AbuseIPDB, GreyNoise, OTX lookups you run here), and build time for the next analyst module. Even ₹200 / $3 covers a real chunk of a month's API headroom.
International Visa/Mastercard are accepted through Razorpay below.
No community votes yet.