Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
Search IPs, domains, hashes, and CVEs across 1,986 threat intelligence reports.
Find answers to common questions about IOC Radar
IOC Radar is a free threat intelligence lookup tool by SOCRadar for Indicators of Compromise (IOCs). You can look up IP addresses, domain names, URLs, file hashes (MD5, SHA1, SHA256) and CVEs. Each indicator page is built from the threat feeds and research reports IOC Radar collects, plus SOCRadar platform data where available: a confidence and risk score, the reports that mention the indicator and, where a report or feed names one, the threat actor or malware family behind it.
Enter the IP address into the IOC Radar search bar. The page shows a risk score (0–100) and confidence, the threat feeds and reports that list the IP, geolocation and ASN, proxy, Tor and hosting flags, VirusTotal detections where available, and the actors and malware families those reports name. An IP listed by several independent sources scores higher.
Domain and URL lookups return a risk score and confidence, the threat feeds and reports that list the indicator, WHOIS registration details for a domain (registrar, creation and expiry dates) and VirusTotal detections where available, and the actors, malware families and campaigns those reports link to it. IOC Radar does not collect DNS history or SSL certificates.
File hash lookups (MD5, SHA1, SHA256) return the malware family when a report or feed names one, the reports that mention the hash, first and last seen dates, the VirusTotal detection ratio where available, and the MITRE ATT&CK techniques of the reports that mention it. IOC Radar does not run samples in a sandbox.
IOC Radar crawls each of its threat feeds and research sources on its own schedule, from hourly for most feeds to daily, so a new indicator usually appears within hours of its publication. Each indicator page shows when it was first and last seen, and the landing page shows how many sources are active right now.