Threat Intel Lookups for IPs, Domains, URLs & Hashes

Bring your own API keys. Query 10 threat-intel sources in parallel. Nothing touches an H3AD-SEC server.

10Sources

4IOC Types

BYOKYour Keys

HOW TO USE

Add your keys: press / or click 🔑 KEYS in the nav, paste your source API keys, click SAVE KEYS. Sources with no key are simply skipped, everything else still runs.
Paste IOCs: one per line or comma/space separated, into Quick Lookup (single IOC) or Bulk IOC Input (many at once, paste or upload a file). Defanged IOCs (hxxp, [.], (dot)) are auto-refanged before parsing.
Analyze: every configured source is queried in parallel per IOC; results stream into the table as each source responds instead of waiting for the slowest one.
Drill in or export: click DETAIL on any row for a full per-source breakdown, or export the whole table (or just one IOC) as CSV, JSON, Markdown, TXT, or Excel.

SHORTCUTS

/Open Keys

CtrlEnterAnalyze

CtrlKFocus Quick Lookup

EscClose modal

CAPABILITIES

Retry failed lookupsA source that fails from a network error or timeout gets its own retry, right there: retry just that one source from inside DETAIL, retry every failed source for one IOC from the results table, or retry every failure across the whole batch at once, without re-querying sources that already succeeded.

10 sources, one queryVirusTotal, AbuseIPDB, AlienVault OTX, ThreatFox, IPLocate, URLScan, URLhaus, MalwareBazaar, HybridAnalysis, and FileScan.io. Each source only runs for the IOC types it actually supports.

Bulk input + dedupPaste hundreds of mixed IOCs at once, or upload a .txt, .csv, .json, or .xlsx file. Duplicates are removed automatically before any source is queried.

Key import/exportImport all 10 keys at once from a JSON, TXT, CSV, Markdown, or Excel file, or download a blank template in any of those formats to fill in offline.

4 IOC types, auto-detectedIPv4/IPv6, domains, URLs, and MD5/SHA1/SHA256/SHA512 hashes are recognized automatically from pasted text, no need to sort them yourself.

Light / dark themesToggle from the nav; the choice is remembered on your next visit.

Per-IOC or full exportExport the whole result set, or just a single IOC's row, in CSV, JSON, Markdown, TXT, or Excel. Exports stay lean by design, each source's verdict/score, not every extra field, IPLocate is the one exception and always exports in full for IP/IPv6 rows since that context is essential. In BULK mode, choose a Summary export (VT + OTX + URLhaus, matching the table) or Full details (all 10 sources); in a type-specific mode, export automatically includes only that IOC type's own relevant sources, no blank columns.

GET YOUR API KEYS

All 10 sources offer a free tier. Sign up direct with each vendor. IOC-VERDIKT never sees or stores these keys, they stay in your browser.

VirusTotal ↗ AbuseIPDB ↗ AlienVault OTX ↗ ThreatFox ↗ IPLocate ↗ URLScan ↗ URLhaus ↗ MalwareBazaar ↗ HybridAnalysis ↗ FileScan.io ↗

ThreatFox, URLhaus, and MalwareBazaar are all run by abuse.ch and share one Auth-Key from the same sign-up.

READING YOUR RESULTS

DETAIL modalClick DETAIL on any row to open the full per-source breakdown: reputation scores, categories, first/last seen dates, tags, and a direct link out to that source's own page for the IOC. Any source that failed shows a RETRY button right on its card.

Search & filterUse the results search box or the type filter to narrow a large batch down to just the IOCs (or verdicts) you care about.

The results tableOne row per IOC. Each source column shows that source's verdict for THIS row: a colored badge if it ran, or N/A if that source doesn't cover this IOC type or has no key configured. Columns for sources that don't apply to the active bulk-input mode (IP / Domain / Hash) hide themselves entirely instead of sitting there empty. In BULK mode (mixed IOC types), only VirusTotal, AlienVault OTX, and URLhaus show as columns, the three sources that cover every IOC type, everything else is still queried and fully visible in DETAIL for each row.

Column abbreviations

VTVirusTotal ABAbuseIPDB OTXAlienVault OTX TFThreatFox COUNTRYIPLocate geolocation FLAGSPrivacy/risk flags (IP only) DOMAINReverse-DNS (IP only) USURLScan UHURLhaus MBMalwareBazaar HAHybridAnalysis FSFileScan.io

Hover any column header in the results table for the full name too.

QUICK LOOKUP

BULK IOC INPUT

Auto-detects IPv4 · IPv6 · Domains · URLs · MD5/SHA1/SHA256/SHA512 · Defanged IOCs · Deduplication

DROP FILE OR CLICK TO BROWSE

.txt · .csv · .json · .xlsx