IOC Inspector

Look up URLs, domains, and IPs across multiple threat intelligence sources from one place. By RYMANTECH.

IOC Inspector is a fast, minimalist threat intelligence aggregator for security analysts, SOC teams, and IT professionals. Paste any URL, domain, or IP address, and the extension queries multiple threat intelligence APIs in parallel — then provides one-click links to additional lookup pages. — WHAT YOU GET — The extension calls the following APIs in parallel and displays a verdict for each: - VirusTotal returns aggregated results from 90+ antivirus engines, with reputation, country, and network owner. - AbuseIPDB returns community-reported abuse scores, report counts, ISP, and Tor flag (IP addresses only). - URLScan.io returns the most recent scan, page categorization, and malicious verdict. - AlienVault OTX returns pulse count, threat campaigns, and ASN. - abuse.ch ThreatFox returns malware IOC matches, malware family, and threat type. - abuse.ch URLHaus returns malware distribution sites, online URL count, and blacklist hits. For sources that don't offer a public API, the extension provides one-click links that open the relevant lookup pages in new tabs. The full list of supported third-party lookup pages is shown in the extension's settings. — BUILT FOR DAILY SOC USE — - Auto-detects whether your input is an IP address or URL/domain. - Pre-fills with the current tab's hostname when you open the popup. - Right-click context menu: highlight any URL or IP and choose "Inspect with IOC Inspector". - Recent searches dropdown — the last 10 scans are cached so you can re-view results without burning API quota. - Color-coded verdict badges: clean, suspicious, or malicious. - One-click "Open All" button launches every manual lookup in background tabs. - Light and dark themes. — EXPORT YOUR FINDINGS — - Copy as formatted text — useful for ticketing systems, chat tools, or note-taking apps. - Save as PNG — a clean screenshot of all API results. - Save as PDF — a print-ready report with full styling. — PRIVACY-FIRST — - Bring your own API keys — no third-party server sits in the middle. - All processing happens locally in your browser. - No analytics, no telemetry, no tracking. - Keys are stored using Chrome's encrypted sync storage. - Open source on GitHub. — FREE API KEYS — All API keys used by this extension are free. - VirusTotal — 4 requests/minute, 500/day. Get a key at virustotal.com/gui/my-apikey. - AbuseIPDB — 1,000 IPs/day. Get a key at abuseipdb.com/account/api. - abuse.ch — one key works for both ThreatFox and URLHaus. Register at auth.abuse.ch. URLScan.io and AlienVault OTX require no key. — SUPPORTED LOOKUPS — IPv4 addresses, hostnames, full URLs, and bare domains. The right-click context menu works on links and selected text on any page. — BY RYMANTECH — Built by security professionals, for security professionals.