01 · Product name
Open Threat Exchange
LevelBlue's free indicator exchange. Account is separate.
Published by LevelBlue.
In short
Open Threat Exchange is the indicator community at otx.alienvault.com. On 22 Oct 2026 the page title was LevelBlue - Open Threat Exchange. The homepage said Gain FREE access to over 20 million threat indicators contributed daily, and named over 200,000 global participants. It says the account is separate from the LevelBlue Community and legacy Open Threat Exchange accounts. The owasp.org page showed Pulses 40 and Files 0. The 8.8.8.8 page showed Pulses 0 and Passive DNS 500+. No price and no SPDX field were printed.
Product pricing strategy
02
Free
The homepage, opened 22 Oct 2026, says Gain FREE access. No dollar price, no plan table, and no SPDX field were printed on the homepage or on the two indicator pages. Free is the homepage's word. It is not an SPDX identifier, and this listing does not invent one. The over 20 million indicators sentence and the over 200,000 participants sentence are the homepage's counts. They are not fees. A separate account from the LevelBlue Community is an account boundary, not a second product price. The indicator pages did not show a checkout. If a LevelBlue product beside OTX is sold, its price was not on these pages and is not quoted.
Utility and features
03
The homepage headline offers free access to over 20 million threat indicators contributed daily, and collaboration with over 200,000 global participants. This listing quotes those sentences as printed. It does not turn contributed daily into a rate the page did not calculate. The sign-up note says this is a separate account from the LevelBlue Community and legacy Open Threat Exchange accounts. The page also names a free malware-analysis path inside LevelBlue Labs OTX sandbox. No dollar price was on the homepage.
- Homepage counts stay as printed. Over 20 million threat indicators contributed daily, and over 200,000 global participants. The account is separate from the LevelBlue Community.
- owasp.org is 40 pulses. Passive DNS 409, URLs 1K, Files 0, registrar GoDaddy.com, LLC, created Sep 21, 2001. Analysis was still loading.
- 8.8.8.8 is 0 pulses. Passive DNS 500+, URLs 10, Files Loading, ASN AS15169 google llc. That is not the domain page.
The indicator page for owasp.org is a domain record: Pulses 40, Passive DNS 409, URLs 1K, Files 0, registrar GoDaddy.com, LLC, creation date Sep 21, 2001, related tags 87. The analysis panel still said Loading Analysis. The IPv4 page for 8.8.8.8 showed Pulses 0, Passive DNS 500+, URLs 10, Files still Loading, location United States of America, ASN AS15169 google llc. Files 0 on the domain page and Files Loading on the IP page are different states. 1K and 500+ are the page's own abbreviations. They are not expanded here. No SPDX field was printed.
- 1
Quote 1K and 500+ as the page printed them. Do not expand the abbreviations.
- 2
Keep Files 0 and Files Loading on the indicator each one belongs to.
- 3
Create the OTX account the homepage describes. Do not assume a LevelBlue Community login is the same account.
Caveats
04
Pulses 40 and Files 0 belong to owasp.org. Pulses 0 and Files Loading belong to 8.8.8.8. Do not copy the domain's file count onto the address, and do not treat a Loading panel as a verdict. The analysis panel on the domain page had not finished. URLs 1K stays 1K. Passive DNS 500+ stays 500+.
The account note matters: a LevelBlue Community login is not, on that sentence, an Open Threat Exchange login. The homepage's contributed daily line is not a per-day total this listing computes. An indicator page is a community record. It does not authorize scanning a host, and a pulse is not an attribution. Threat intelligence is the category because the pages are indicator records. The maintainer name used here is LevelBlue, from the page title.
Screenshots
05
Potential use cases
06
- The homepage counts are about to be turned into a rate. On 22 Oct 2026 the page said Gain FREE access to over 20 million threat indicators contributed daily, and Collaborate with over 200,000 global participants. Leave those sentences as printed. Do not divide 20 million by a day. The sign-up note says the account is separate from the LevelBlue Community and legacy Open Threat Exchange accounts.
- Files 0 is about to move onto 8.8.8.8. The owasp.org page showed Pulses 40, Passive DNS 409, URLs 1K, Files 0, registrar GoDaddy.com, LLC, and creation date Sep 21, 2001. The analysis panel still said Loading Analysis. The 8.8.8.8 page showed Pulses 0, Passive DNS 500+, URLs 10, and Files Loading. 1K and 500+ stay abbreviated.
- A pulse is about to be briefed as an attribution. The indicator pages are community records. They do not authorize a scan, and a loading analysis panel is not a verdict. No dollar price and no SPDX field were printed. The page title is LevelBlue - Open Threat Exchange. That is the maintainer name used here.
Hard cases
The case where the first result is easy to over-read.
1K is expanded and Files 0 is copied
URLs 1K is the domain page's abbreviation. Passive DNS 500+ is the IP page's abbreviation. Files 0 belongs to owasp.org. Files Loading belongs to 8.8.8.8. Expanding the abbreviations or swapping the file states invents a panel the page did not show.
Practitioners using it
Posts on X from people describing a concrete use. The quote is the post. Likes and reposts are the counts saved with it, not a live total. A label marks a creator, a maintainer, a vendor, a partner, a data partner, or an investor.
Day 42 - Build Log Today I continued working on my CyBlack Internship task under the Threat Intelligence sprint. My team and I successfully deployed OpenCTI with the AlienVault OTX connector on AWS, which solved our system limitation issues and gave us centralized, remote… https://t.co/AIPUU8rvos pic.twitter.com/5WlgCbCrV3
As part of my @Cyblackorg internship I completed a threat assessment using OpenCTI and AlienVault OTX to gather information about an organization’s threat landscape. 👇🏻 @ireteeh https://t.co/uPtgfneYgy
Just wrapped the Cyber Threat Intelligence Sprint with Team 3 at @CyBlack using OpenCTI + AlienVault OTX mapped MITRE ATT&CK techniques, indicators, and victimology data for threats actively targeting the US.Huge thanks to my teammates for their collaboration. #SOC #CyBlack pic.twitter.com/QKdlK6YK5q
Last Saturday, we wrapped the @Cyblackorg CTI Sprint, putting CTI theory into hands-on practice. I deployed OpenCTI, integrated AlienVault OTX, troubleshot the CTI infrastructure & worked with my team on threat analysis using the Diamond Model, Cyber Kill Chain and MITRE ATT&CK. pic.twitter.com/PIaSDhjwA1
Questions
Is Open Threat Exchange free?
The homepage says Gain FREE access. No dollar price and no SPDX field were printed on 22 Oct 2026. The sign-up note says the account is separate from the LevelBlue Community and from legacy Open Threat Exchange accounts.
What did the owasp.org indicator page show?
Pulses 40, Passive DNS 409, URLs 1K, Files 0, registrar GoDaddy.com, LLC, creation date Sep 21, 2001. The analysis panel still said Loading Analysis.
Citations
07
Titled sources. These public pages are what the quotes on this listing come from.
Product
Open Threat Exchange
https://otx.alienvault.com/Documentation
OTX domain record for owasp.org
https://otx.alienvault.com/indicator/domain/owasp.orgDocumentation
OTX IPv4 record for 8.8.8.8
https://otx.alienvault.com/indicator/ip/8.8.8.8