How to Use the CyberHawk IOC Scanner

The IOC Scanner is accessible from multiple entry points on the platform — the main navigation bar, the Resources section, and the CyberHawk homepage quick-access panel. You can scan as a guest for basic results, but a free registered account unlocks full enrichment data, scan history, and downloadable reports.

◈ How to Get There

• 1Navigate to cyberhawkthreatintel.com/ioc-scanner directly
• 2Or from the homepage, click IOC Scanner in the top navigation bar
• 3Or from the Resources page, scroll to the Security Operations section and click IOC Hunt
• 4For full features: Register or Log In to your free CyberHawk account before scanning
• 5The scanner interface loads with the search input bar in the centre — you're ready to scan

IP address scanning is the most common use case — checking whether a source IP from a SIEM alert, firewall log, or authentication event is known-malicious. The scanner checks the IP against the CyberHawk threat database and enrichment sources, returning reputation data, geolocation, ASN ownership, abuse history, and active threat campaign associations.

◈ How to Scan an IP

• 1In the IOC Scanner input bar, type or paste the IP address — e.g. 185.220.101.47
• 2The scanner auto-detects the input type as IPv4 Address and shows the type indicator
• 3Press Enter or click the Scan button
• 4The results panel loads — review the Verdict Banner at the top (MALICIOUS / SUSPICIOUS / CLEAN)
• 5Scroll through the result sections: Threat Score, Geolocation, ASN, Abuse Reports, Active Campaigns
• 6Check the Tags section — labels like Tor Exit Node, C2 Server, Brute Force, Scanner show what the IP is used for
• 7Review First Seen / Last Seen dates — a recently-active C2 IP is a higher priority than stale data

Domain scanning covers phishing domains, C2 infrastructure domains, malware distribution sites, and lookalike domains used in brand impersonation attacks. The scanner resolves the domain, checks its reputation, retrieves WHOIS registration data, and cross-references it against known threat actor infrastructure lists.

◈ How to Scan a Domain

• 1Paste the domain name — e.g. malware-c2-domain.ru — without http:// prefix
• 2The scanner auto-detects the type as Domain
• 3Click Scan — the tool resolves DNS, fetches WHOIS, and queries threat databases simultaneously
• 4Review the verdict and threat score at the top of the results panel
• 5Check the DNS Records section — A, MX, NS, TXT records show current infrastructure
• 6Review WHOIS data — registration date, registrar, registrant country (note: newly registered domains = higher risk)
• 7Check Resolved IPs — these can be fed back into the IP scanner for further pivot
• 8Review Subdomains if available — attacker infrastructure often uses multiple subdomains

URL scanning goes deeper than domain scanning — it analyses the full path, query parameters, and URL structure for known malicious patterns. Commonly used to check URLs extracted from phishing emails, malware samples, or suspicious redirect chains without visiting the site yourself. The scanner also handles defanged URLs so you never need to refang before submitting.

◈ How to Scan a URL

• 1Paste the full URL — defanged format accepted: e.g. hxxps://evil[.]site/payload/stage2.exe
• 2The scanner detects the type as URL and auto-refangs any defanging before processing
• 3Click Scan — the URL is checked without your browser sending any request to it
• 4Review the URL Pattern Analysis — flags like IP-based URL, Suspicious Path, Double Encoding are highlighted
• 5Check the Domain Reputation sub-section for the base domain's threat history
• 6Review File Type Indicator — if the URL path ends in an executable or script extension, it's flagged
• 7Note any Redirect Chain data — some URLs point through multiple redirectors before reaching the final payload

File hash scanning lets you check whether a file is known malware without executing it. Submit an MD5, SHA1, or SHA256 hash — extracted from an EDR alert, a suspicious attachment, or a threat report — and the scanner returns the full malware profile if the hash is in the threat database, including malware family, behaviour tags, and detection history.

◈ How to Scan a File Hash

• 1Copy the file hash from your EDR, AV alert, or use the Hash Generator tool to create one from a file
• 2Paste the hash — MD5 (32 chars), SHA1 (40 chars), or SHA256 (64 chars) all accepted
• 3The scanner auto-detects the hash type by length
• 4Click Scan — the hash is checked against the CyberHawk malware database and enrichment sources
• 5If matched, review the Malware Profile: family name, type (Trojan, Ransomware, RAT, Stealer, Loader)
• 6Check Detection Names across AV vendors — multiple detection names confirm the classification
• 7Review First Seen date — old hashes from years ago may be repacked or reused
• 8Note any Related Hashes — variants of the same malware family that may also be present

Email address scanning identifies whether a sender address is associated with spam campaigns, phishing operations, credential stuffing attacks, or known threat actor personas. Particularly useful during BEC (Business Email Compromise) investigations, phishing triage, and when a user reports a suspicious sender. The scanner checks the address itself and also profiles the sending domain's mail infrastructure.

◈ How to Scan an Email Address

• 1Extract the sender email address from the suspicious email
• 2Paste the full email address — e.g. [email protected]
• 3The scanner detects the type as Email Address
• 4Click Scan — the address and its domain are both checked
• 5Review Email Reputation — has this specific address appeared in known spam or phishing campaigns?
• 6Review Domain Mail Infrastructure — SPF, DKIM and DMARC configuration of the sending domain
• 7Check Breach Data Indicator — if the address has appeared in known data breaches, it may be a compromised account being weaponised
• 8Note the Domain Registration Age — freshly registered sending domains are a strong phishing signal

Every scan produces a structured results panel with consistent sections regardless of IOC type. Understanding the layout means you can triage scan results in seconds rather than reading every field from top to bottom.

◈ Results Panel Layout — Top to Bottom

• 1Verdict Banner — the most important section. MALICIOUS (red), SUSPICIOUS (orange), CLEAN (green), or UNKNOWN (grey). Always shown first.
• 2Threat Score — numeric score 0–100. Above 70 = High, 40–70 = Medium, below 40 = Low risk. Shown as a visual bar.
• 3Quick Stats Row — key data at a glance: type, category, first seen, last seen, confidence level.
• 4Tags — behavioural and classification labels (e.g. C2, Ransomware, Phishing, Scanner, Tor)
• 5Enrichment Sections — expanded data from each intelligence source. Collapsible sections for Geolocation, WHOIS, DNS, Abuse Reports, Campaign Data.
• 6Pivot Links — clickable related IOCs (resolved IPs, associated domains, related hashes) that let you expand your investigation.
• 7Report / Export — download the full findings as a formatted HTML report at the bottom of the results panel.

The CyberHawk threat score is a composite score calculated from multiple signals — not just a single database lookup. Understanding how it's calculated helps you interpret why an IOC scores the way it does and how much weight to give it during triage.

◈ What Contributes to the Threat Score

• 1CyberHawk Database Match — highest weight. A direct match in the CyberHawk proprietary threat database is the strongest signal.
• 2Abuse Reports — number of independent abuse complaints filed against the IP, domain, or email.
• 3Recency — how recently the IOC was last seen as active. Very recent activity raises the score; stale data from 2+ years ago lowers it.
• 4Infrastructure Signals — bulletproof hosting ASNs, Tor exit nodes, known VPN/proxy ranges, datacenter-only IPs all contribute to higher base scores.
• 5Domain Age — newly registered domains (under 30 days) receive an automatic score uplift as a risk signal.
• 6Campaign Association — if the IOC is linked to a named active threat campaign, this significantly increases the score.
• 7Enrichment Source Consensus — if multiple independent sources all flag the same IOC, the score increases proportionally.

The IOC Scanner doesn't rely on a single data source — it aggregates intelligence from multiple live threat feeds and OSINT sources simultaneously to build the most complete picture possible. Each source contributes different data, and you can see which sources returned data in the results panel.

◈ Intelligence Sources

• 1CyberHawk Proprietary DB — the core source. IOCs tracked, validated and tagged by the CyberHawk threat intelligence team in real time.
• 2AbuseIPDB — community-sourced IP abuse reports. Shows report count, abuse categories and last reported date.
• 3WHOIS / RDAP — domain and IP registration data. Shows ownership, registration timeline and contact abuse reporting details.
• 4Passive DNS — historical DNS resolution data. Shows what IPs a domain has resolved to over time and what other domains share those IPs.
• 5ASN / BGP Data — autonomous system information. Identifies the network owner and whether the ASN is associated with bulletproof or abuse-heavy hosting.
• 6Live Threat Feeds — aggregated open-source CTI feeds including C2 tracker feeds, phishing databases, and malware hash databases.

Every scan can be exported as a formatted HTML report — ready to attach to a security ticket, include in an incident report, or share with stakeholders. The report preserves all result sections, the verdict, enrichment data, and timestamps exactly as displayed in the scanner.

◈ How to Download a Report

• 1Complete a scan on any IOC type and wait for all results to load
• 2Scroll to the bottom of the results panel
• 3Click the Download Report button — a formatted HTML report file is generated
• 4The report downloads to your local machine with the filename format: ioc-report-[indicator]-[timestamp].html
• 5Open the file in any browser — it renders as a standalone, offline-viewable report with full formatting
• 6Attach the report to your incident ticket, email it to stakeholders, or store it in your case management system

Registered CyberHawk accounts unlock additional features that significantly improve investigation workflows — particularly the scan history, which lets you retrieve and compare previous scans without re-running them. Registration is completely free.

◈ Account Features

• 1Scan History — all your previous IOC scans are stored and searchable in your account dashboard. Revisit any past scan instantly.
• 2Full Enrichment Data — registered accounts see the complete enrichment dataset. Guest scans show a reduced result set.
• 3Faster Results — authenticated scans are prioritised in the queue for faster enrichment turnaround.
• 4Re-scan Alerts — re-run old scans to check if the threat score has changed (useful for monitoring IOCs over time during long incidents).
• 5Access to All Platform Features — your scan history integrates with the full CyberHawk platform including the IOC Hunt bulk tool, threat briefings, and the live threat database.

A user reports a suspicious email. This is the exact sequence to run through the CyberHawk platform for a complete triage.

• 1Paste raw email headers into the Email Header Analyser → get originating IP and SPF/DKIM/DMARC results
• 2Scan the originating IP in the IOC Scanner → check reputation and campaign associations
• 3Scan the sender email address → check for phishing history and domain age
• 4Extract all URLs from the email body using the IOC Extractor
• 5Scan each extracted URL in the IOC Scanner → identify malicious landing pages
• 6If an attachment hash is available, scan it → confirm malware family if matched
• 7Download reports for all confirmed malicious IOCs → attach to the security ticket

Your SIEM fires an alert for suspicious outbound traffic to an unknown IP. Here's the rapid triage flow.

• 1Copy the destination IP from the SIEM alert and scan it in the IOC Scanner
• 2If MALICIOUS — check the Campaign Association field to understand what threat group or malware family is using this IP
• 3Click the Pivot to Passive DNS section — identify other domains pointing to the same IP
• 4Scan the associated domains to map the full C2 infrastructure
• 5Feed the full IP and domain list into the IOC Hunt tool for bulk confirmation
• 6Use the CIDR of the malicious ASN from the scan results in the CIDR Calculator to scope blocking rules
• 7Download all reports → escalate to incident response with full evidence package

You receive a new threat intelligence report with dozens of IOCs. Here's how to rapidly validate and prioritise them.

• 1Paste the full threat report text into the IOC Extractor → extract all IPs, domains, hashes and URLs in one pass
• 2Copy the full extracted IOC list into IOC Hunt → bulk scan all indicators simultaneously
• 3IOC Hunt returns a MATCH / CLEAN / UNKNOWN verdict for every indicator — focus on the MATCH results
• 4Click each MATCH to pivot to the full IOC Scanner report for deep enrichment
• 5Defang all confirmed malicious IOCs using the IOC Defanger for safe sharing in reports and Slack
• 6Export the complete findings and push confirmed IOCs to your SIEM or MISP instance