tomchop/malcom

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

1171 stars · 215 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Malcom is a Python web application that analyzes network traffic (including pcaps) and visualizes malware communications as graphs, cross-referenced with known-bad threat intelligence feeds. It helps analysts identify C&C servers, peer-to-peer networks, and fast-flux DNS infrastructure.

Use cases

• analyze malware network communications
• detect command and control servers
• check if an IP or domain is known-bad
• visualize pcap network traffic as a graph
• understand malware peer-to-peer infrastructure
• correlate network artifacts with threat intelligence feeds

When to choose

• you need graphical analysis of malware network traffic
• you want to cross-reference traffic with threat intel feeds
• you're doing DFIR work on a compromised host's communications

When to avoid

• you need actively maintained software - the last release was in 2017
• you can't run services as root or manage mongodb/redis dependencies
• you need modern TLS interception or Windows support guarantees

Facets

application · maturity abandoned

networking search-engine data-visualization security security networking developer-tools python self-hosted malware-analysis threat-intelligence dfir pcap-analysis network-traffic c2-detection infosec linux docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="tomchop/malcom")