Last updated:
🧰 Checking an IOC Without a Threat-Intel Platform
Most indicators can be checked in a minute with free tools and no account. The skill is reading the answers, which often disagree.
Quick answer: For a handful of indicators a day, free browser tools are enough. Refang the indicator, skip private addresses, and read each source’s answer side by side. Move to a platform such as MISP or OpenCTI when you need history, sharing or your own paid feeds.
What can a free browser lookup tell you?
More than most people expect, and with no keys. These sources answer a web page directly or over DNS:
- Shodan InternetDB returns an address’s open ports, known CVEs, hostnames and tags. It needs no API key and is refreshed weekly Shodan, Introducing the InternetDB API.
- Team Cymru IP to ASN maps any address to its BGP prefix, origin network and registry record. It is free and can be queried over DNS Team Cymru, IP to ASN mapping (read 4 Nov 2026).
- Team Cymru’s Malware Hash Registry gives the last time a file was seen and the share of antivirus engines that flagged it. It is free for non-commercial use Team Cymru, Malware Hash Registry (read 4 Nov 2026).
- CIRCL hashlookup answers the opposite question: is this hash a known, legitimate file CIRCL hashlookup?
Max Intel’s IP lookup and hash page query these for you, alongside OTX, GreyNoise, ISC SANS and abuse.ch.
Why read the signals, not one score
Every source measures something different. A sandbox rates behaviour. An antivirus rate counts engines. A known-file list says nothing about intent. Averaging them hides the disagreement you most need to see.
We checked the MD5 of an empty file on 4 November 2026. Team Cymru’s registry showed a 91% antivirus detection rate. CIRCL listed the same hash as a known file with trust 100 out of 100. Both answers are real; neither is a verdict.
The most useful details are often tags, not scores. The same day, a hosting address we looked up was tagged c2 by Shodan and had port 50050 open. Cobalt Strike’s own advice for spotting team servers is to search for that port Cobalt Strike, team server population study. Yet one free aggregator still called the address clean. Look for the tags first.
How do I handle indicators safely?
- Refang to look up, defang to share. Reports write
evil[.]comandhxxp://so links cannot be clicked. Turn them back for lookups, and defang them again in your notes. Max Intel’s search boxes now refang automatically. - Skip private addresses. Ranges such as 10.0.0.0/8 and 192.168.0.0/16 are private RFC 1918. 100.64.0.0/10 is shared space behind carrier-grade NAT RFC 6598. Public feeds know nothing about them. Search your own logs instead.
- Search before you upload. Looking up a hash shares only the hash. Uploading a file can share the file itself, so read each service’s terms first.
- Keep one note format. Copy the Markdown summary into your case notes, or export STIX 2.1 for a platform.
When should I move to a threat-intel platform?
A browser tool forgets everything when you close the tab. Move up when you need history, correlation, sharing or your own paid feeds. The main free options all run on your own server:
- IntelOwl queries many online services and malware analysis tools about a file or observable, from one place IntelOwl project (read 4 Nov 2026). It is built on Docker IntelOwl project (read 4 Nov 2026).
- MISP is open-source software for collecting, storing and sharing security indicators MISP project (read 4 Nov 2026).
- OpenCTI is an open-source threat-intel platform; the community edition is Apache 2.0 licensed OpenCTI on GitHub (read 4 Nov 2026).
- Yeti aims to connect threat intelligence with forensics and incident response work Yeti platform (read 4 Nov 2026).
- IP Radar is a lighter middle step. It is a self-hosted IP checker that pulls about 60 feeds, 53 of them keyless IP Radar on GitHub (read 4 Nov 2026).
Rule of thumb: if you paste the same indicator into five tabs several times a day, use a platform or a script.
Frequently asked questions
Can I check an IOC without a threat-intel platform?
Yes. Free sources such as Shodan InternetDB, Team Cymru and CIRCL hashlookup answer without an account. Browser tools like Max Intel's IP triage and IOC extractor query them for you.
What is the best free IOC lookup tool?
There is no single best one, because sources measure different things. Use a tool that shows each source's answer side by side, and read the tags as well as any score.
Why do VirusTotal and a sandbox give different scores for the same file?
They measure different things. VirusTotal counts antivirus engines that flag a file, while a sandbox rates what the file did when run. Do not average them.
What does refang mean?
Reports defang indicators, such as evil[.]com, so they cannot be clicked. Refanging turns them back into real values so tools can look them up.
Should I look up private IP addresses?
No. Private ranges such as 10.x and 192.168.x, and shared 100.64.x addresses, are not on the public internet. Search your own network logs instead.
When do I need MISP, OpenCTI or IntelOwl?
When you need to keep history, correlate indicators, share with partners or use your own paid feeds. All three are free and open source, but you host and maintain them.