Paste an IP address, domain, URL or file hash to see if it is malicious. One scan gives its VirusTotal reputation, WHOIS and domain age, hosting network (ASN), DNS, where a short link really leads, and its TLS certificate, then pivots in one click to public threat intelligence. Built for SOC triage, free and without sign-up.
No indicator scanned yet
Pivot the indicator to public reputation, WHOIS and infrastructure services.
// built-in probes work without API keys · VirusTotal enrichment depends on server configuration
During incident triage, analysts often jump between many tabs and services. This tool centralizes IOC lookup so you pivot faster between DNS OSINT, HTTP/TLS checks, and reputation sources - reducing context switching during threat intelligence and security investigations.
Enter an IOC (IP, domain, URL, or hash) - the type is detected automatically.
Run the built-in probes and inspect the technical output (DNS, PTR, HTTP/TLS).
Pivot to external intelligence services for deeper context.
Paste it in the IOC lookup: the scan shows its VirusTotal detections, who owns the network (ASN and RDAP), its DNS records and, for a domain, its registration date. One-click pivots then open AbuseIPDB, GreyNoise, Shodan and other reputation services on the same indicator.
Scan the domain: the Registration & hosting section reads the official registry over RDAP (the successor of WHOIS) and shows the creation date, expiry, registrar and DNSSEC. Domains registered in the last 30 days are flagged, since phishing domains are usually used within days of registration.
Paste the short URL (bit.ly, t.co, etc.): the HTTP probe follows each redirect from this server and shows the chain hop by hop with the final destination, without opening the link in your browser. A warning appears when it lands on another domain.
Yes. MD5, SHA-1 and SHA-256 hashes are detected automatically and checked against VirusTotal, with pivots to MalwareBazaar and Hybrid Analysis. The EML Analyzer sends attachment hashes here in one click.
It is free with no sign-up and no key to provide. DNS, RDAP, ASN and HTTP checks run on this server; VirusTotal results use the site's own key.
Looking up public reputation, DNS and registration data is passive. Only probe systems and indicators you are authorized to investigate; unauthorized probing may violate law or policy.