What Is the IOC Scanner?
The CyberHawk IOC Scanner is a live threat intelligence enrichment tool built for SOC analysts, threat hunters, red teamers, and security researchers. It takes any Indicator of Compromise (IOC) you throw at it — an IP address, domain, URL, file hash, or email address — and instantly cross-references it against multiple threat intelligence sources, returning a consolidated enrichment report in seconds.
No tab-switching. No manual lookups. No wasted time.
What IOC Types Can You Scan?
The scanner accepts five indicator types:
IP Addresses — IPv4 and IPv6, including internal range detection
Domains — Full domain names and hostnames
URLs — Full URLs including paths and query strings
File Hashes — MD5, SHA1, and SHA256
Email Addresses — Full email address OSINT enrichment
You can enter a single IOC or bulk-paste multiple indicators and scan them in one session.
How to Run a Scan
Navigate to IOC Scanner from the top navigation or Resources menu
Paste your IOC into the input field
The scanner auto-detects the indicator type — no manual selection needed
Hit Scan and results load within seconds
Review the enrichment report, expand sections for detail, copy or export
That's it. The entire workflow from paste to intelligence takes under 10 seconds.
What Enrichment Sources Are Queried?
When you submit an IOC, the scanner fires parallel queries across multiple threat intelligence sources simultaneously:
For IP Addresses:
AbuseIPDB — abuse confidence score, report count, ISP, usage type
VirusTotal — detection ratio across 90+ security vendors
Shodan — open ports, running services, banners, vulnerabilities
GreyNoise — internet background noise classification (malicious vs benign scanner)
IPinfo — geolocation, ASN, organisation, hosting provider
Feodo Tracker — C2 botnet infrastructure checks
CyberHawk IOC Database — cross-reference against our proprietary threat database
For Domains:
VirusTotal — vendor detection, WHOIS, DNS records, subdomains
URLhaus — malware distribution URL checks
URLscan.io — live screenshot, DOM analysis, redirect chains
WHOIS lookup — registrar, creation date, expiry, registrant
DNS resolution — A, MX, NS, TXT record enumeration
CyberHawk IOC Database — match against known malicious domains
For URLs:
VirusTotal — full URL scan across all vendor engines
URLhaus — active malware distribution status
URLscan.io — live sandbox screenshot and page analysis
PhishTank — phishing URL database check
Google Safe Browsing — real-time safe browsing verdict
Redirect chain analysis — full chain of redirects resolved
For File Hashes:
VirusTotal — full hash lookup, file name, file type, first/last seen, all vendor detections
MalwareBazaar — malware family, tags, signature, origin
Hybrid Analysis — sandbox behaviour summary
CyberHawk IOC Database — match against known malware hash repository
For Email Addresses:
HaveIBeenPwned — breach exposure check, which breaches, what data leaked
Hunter.io — email validation, deliverability score, domain organisation
Gravatar — linked profile photo, display name, bio
Microsoft tenant discovery — Azure AD / M365 tenant identification
Domain WHOIS + MX records — email domain infrastructure intel
Understanding Your Results
Every scan returns a structured enrichment report broken into clear sections:
Verdict Banner
At the top of every report, you get an instant verdict:
🔴 MALICIOUS — confirmed by one or more threat intel sources
🟠 SUSPICIOUS — flagged but not confirmed malicious
🟡 UNKNOWN — no intelligence found, proceed with caution
🟢 CLEAN — no detections across all queried sources
Threat Score
A composite 0–100 threat score calculated from the weighted results of all sources queried. Higher score = higher confidence of malicious activity.
Detection Breakdown
A source-by-source breakdown showing exactly which engines flagged the IOC and what verdict each one returned. You can see the raw detection ratio (e.g. 14/90 vendors on VirusTotal) at a glance.
Geolocation & Network Intel
For IPs and domains:
Country, city, latitude/longitude
ASN number and organisation
Hosting provider / ISP
Abuse contact email
Open Ports & Services (IP)
Powered by Shodan — see exactly what services are exposed on a malicious IP, including banners that may reveal software versions or C2 panel paths.
WHOIS & DNS Records
Full registration data including creation date, registrar, name servers, and all DNS record types. Useful for identifying domain age (newly registered domains are high risk), registrar patterns, and infrastructure clustering.
Malware Family & Tags (Hash)
For file hashes, MalwareBazaar returns the malware family name, associated campaign tags, file type, and packer information — giving you immediate context for your incident response workflow.
Breach Details (Email)
For email addresses, HIBP returns the specific breach names, dates, and data types exposed (passwords, phone numbers, addresses, etc.) — giving you actionable context for phishing risk assessments and identity exposure reports.
CyberHawk Proprietary Match
If the IOC exists in our own threat database — sourced from dark web monitoring, honeypot feeds, and curated threat intelligence — you'll see that match highlighted separately with additional context including first seen, last seen, severity, and associated campaign.
How to Use Results in Your Workflow
SOC Triage
Paste the IP or domain from your alert directly into the scanner. The instant verdict and threat score tell you within seconds whether to escalate or close the ticket.
Threat Hunting
Take IOCs from threat reports, APT disclosures, or your SIEM and bulk check them against live sources. The scanner tells you which ones are actively malicious right now — not just historically flagged.
Phishing Investigation
Paste the sender email address and the URL from the phishing email. You'll get breach exposure on the email, sandbox screenshot of the URL, phishing database matches, and redirect chain — everything you need to write a complete phishing report.
Malware Analysis Support
Grab the hash from your EDR alert and scan it. Get the malware family name, vendor detections, and associated tags immediately — before you even open a sandbox.
Red Team Recon
Check your infrastructure IPs and domains against abuse and blocklist databases before an engagement to ensure your C2 servers aren't already flagged.
Incident Response Reporting
Every scan generates a structured report you can reference directly in your IR documentation, complete with source attributions and timestamps.
Pro Tips for Power Users
Auto-type detection saves time — just paste and go, no need to select the IOC type manually
Bulk scanning lets you check multiple IOCs from a single paste — ideal for processing IOC lists from threat reports
Scan history keeps a session log of everything you've checked — no need to re-scan the same IOC twice
Copy report exports the enrichment data for pasting directly into tickets, Slack, or incident reports
Low score ≠ safe — a threat score of 0 on a newly registered domain should still raise suspicion; always check the domain age in the WHOIS section
Combine with Threat Map — spotted a suspicious IP in your logs? Check it on the IOC Scanner, then find it on the Live Threat Map to see its global context
Who Is This Tool Built For?
SOC Analysts (L1–L3) — instant triage without leaving your workflow
Threat Intelligence Analysts — enrichment and pivoting across multiple sources
Incident Responders — rapid IOC validation during live incidents
Red Teamers — infrastructure vetting and target research
Security Researchers — deep-dive enrichment with multi-source corroboration
Students & Learners — real-world hands-on tool to practice threat hunting
Start Hunting Now
The IOC Scanner is free to use at:
👉 https://www.cyberhawkthreatintel.com/ioc-scanner
Registered users get access to full scan history, the proprietary CyberHawk IOC database matches, and priority enrichment across all sources.
👉 Register Free
Already have an account?
👉 Login
Explore More on CyberHawk Threat Intel
Beyond the IOC Scanner, the platform gives you access to:
🗺️ Live Threat Map — real-time global IOC visualisation
📚 Courses — structured cyber training built around real threats
🛠️ Resources & Tools — full analyst toolkit
🚨 Threat Intel Feed — live IOC and TTP intelligence
📋 SOPs — analyst playbooks and runbooks
🎥 Video Library — walkthroughs and tool demos
Connect With CyberHawk
Stay sharp and stay connected — follow us across all platforms for daily threat intel, tool drops, and cybersecurity content:
🌐 Website: cyberhawkthreatintel.com
▶️ YouTube: youtube.com/@cyberhawkconsultancy
▶️ YouTube (Secondary): youtube.com/@cyberhawkk
𝕏 X (Twitter): x.com/cyberhawkintel
♪ TikTok: tiktok.com/@cyberhawkthreatintel
✈️ Telegram: t.me/cyberhawkthreatintel
"They can't exploit you if you are the Exploit."
— CyberHawk Threat Intel Team