Search

Find Indicators of compromise (IOCs) from a domain

Domain NameIOC (Indicator of Compromise)

Have a domain? These OSINT tools take a domain as input and return indicators of compromise (IOCs). 104 tools in our catalogue make this exact pivot — compare them by pricing, platform, and what they output, then chain the results into the next step of your investigation.

104tools
All Domain Name tools
SpiderFoot icon

SpiderFoot

Automated OSINT reconnaissance framework

FreeOSSWebCLI
IN+13
OUT+3
VirusTotal icon

VirusTotal

Analyze files, URLs, domains, and IPs

FreemiumWebAPI
IN+2
OUT+1
Wireshark icon

Wireshark

Network protocol analyzer

FreeOSSDesktop AppCLI
IN
OUT
urlscan.io icon

urlscan.io

Scan and analyze URLs safely

FreemiumWebAPI
IN
OUT+2
ANY.RUN Threat Intelligence Lookup icon

ANY.RUN Threat Intelligence Lookup

ANY.RUN sandboxed runs IOC lookup

FreemiumWebAPI
IN
OUT
AbuseIPDB icon

AbuseIPDB

a community IP reputation database for checking and reporting abusive interne

FreemiumWeb
IN+2
OUT
AlienVault OTX icon

AlienVault OTX

a community threat intelligence exchange for pulses, indicators, malware, and

FreeWeb
IN+2
OUT
Anomali ThreatStream icon

Anomali ThreatStream

Anomali TIP and feed management platform

PaidWebAPI
IN
OUT
Bambenek Labs Feeds icon

Bambenek Labs Feeds

Premium DGA and C2 IOC feeds

PaidWebAPI
IN
OUT
BitSight icon

BitSight

External cyber-risk rating by BitSight

PaidWebAPI
IN
OUT
Blacklist Checker icon

Blacklist Checker

Check IPs and domains against 100+ DNS blacklists

FreemiumWebAPI
IN
OUT
Burp Suite icon

Burp Suite

a commercial web security testing platform for proxying, scanning, and analyz

FreemiumWeb
IN+1
OUT
CIRCL Passive DNS icon

CIRCL Passive DNS

CIRCL passive DNS service for researchers

FreeOSSAPICLI
IN
OUT
CVE Details icon

CVE Details

a searchable vulnerability database for CVEs, vendors, products, versions, an

FreeWeb
IN+1
OUT
Can I Take Over XYZ icon

Can I Take Over XYZ

a community-maintained reference for identifying services vulnerable to subdo

FreeOSSCLI
IN+1
OUT
Censys Search Pro icon

Censys Search Pro

Censys attack-surface management platform

PaidWebAPI
IN
OUT
Cisco Talos Intelligence icon

Cisco Talos Intelligence

a threat reputation portal for IPs, domains, malware, vulnerabilities, and sp

FreeWeb
IN+2
OUT
Cisco Umbrella Investigate icon

Cisco Umbrella Investigate

Cisco DNS-resolver threat intel

PaidWebAPI
IN
OUT
Cortex icon

Cortex

an observable analysis and active response engine used with TheHive and secur

FreemiumOSSCLI
IN+2
OUT
Criminal IP icon

Criminal IP

CTI search engine scoring IPs and domains for threats

FreemiumWebAPI
IN
OUT+2
CryptoScamDB icon

CryptoScamDB

Check a crypto address or domain against known scams

FreeOSSWebAPI
IN
OUT
CyberChef icon

CyberChef

a browser-based data transformation workbench for decoding, parsing, hashing,

FreeOSSCLI
IN+2
OUT
Cyberbro icon

Cyberbro

Extract IOCs from raw text and enrich them across reputation services

FreeOSSWebAPI
IN+2
OUT+1
DNSChecker Malicious icon

DNSChecker Malicious

Cisco Talos free reputation lookup

FreeWeb
IN
OUT
Exploit-DB icon

Exploit-DB

a public exploit archive maintained by Offensive Security for vulnerability r

FreeWeb
IN+1
OUT
Farsight DNSDB icon

Farsight DNSDB

Commercial passive DNS by DomainTools

PaidWebAPI
IN
OUT
Feodo Tracker icon

Feodo Tracker

an abuse.ch tracker for botnet command-and-control indicators associated with

FreeWeb
IN+2
OUT
FortiGuard Web Filter Lookup icon

FortiGuard Web Filter Lookup

Look up a URL, domain or IP reputation and category

FreeWeb
IN
OUT
GitGuardian Public Monitoring icon

GitGuardian Public Monitoring

Monitors public GitHub for an org's leaked secrets and credentials

FreemiumWebAPI
IN
OUT
Google Safe Browsing icon

Google Safe Browsing

a Google service and API for checking URLs against unsafe web resource lists

FreemiumWeb
IN+2
OUT
Greenbone Community Edition icon

Greenbone Community Edition

an open-source vulnerability scanning stack for identifying known issues acro

FreeOSSCLI
IN+1
OUT
Group-IB Threat Intelligence icon

Group-IB Threat Intelligence

Russian-region-focused TI platform

PaidWebAPI
IN
OUT
Grype icon

Grype

a vulnerability scanner for container images, filesystems, and software bills

FreeOSSCLI
IN+1
OUT
Hunt.io icon

Hunt.io

Adversary infrastructure tracking service

FreemiumWebAPI
IN
OUT
IBM X-Force Exchange icon

IBM X-Force Exchange

a threat intelligence sharing and enrichment platform for indicators, malware

FreemiumWeb
IN+2
OUT
InQuest Labs icon

InQuest Labs

InQuest free DFI and IOC hunting tools

FreemiumWebAPI
IN
OUT
Interactsh icon

Interactsh

an out-of-band interaction server used to verify blind vulnerabilities and ca

FreeOSSCLI
IN+1
OUT
JA3 Fingerprint icon

JA3 Fingerprint

Salesforce TLS client-fingerprint standard

FreeOSSCLI
IN
OUT
JARM Fingerprint Hash icon

JARM Fingerprint Hash

Salesforce TLS server-fingerprint tool

FreeOSSCLI
IN
OUT
Jaeles icon

Jaeles

a signature-based web application scanner for detecting security issues and e

FreeOSSCLI
IN+1
OUT
MISP icon

MISP

an open-source threat intelligence platform for sharing indicators, events, g

FreeOSSCLI
IN+2
OUT
Maltrail icon

Maltrail

Detect traffic to malicious domains and IPs from blacklists

FreeOSSCLIWeb
IN
OUT
Malwarebytes Labs icon

Malwarebytes Labs

a threat research publication and malware intelligence source for campaigns a

FreeWeb
IN+2
OUT
Mandiant Advantage icon

Mandiant Advantage

Mandiant TI and APT analytics platform

PaidWebAPI
IN+1
OUT
Microsoft Defender Threat Intelligence icon

Microsoft Defender Threat Intelligence

Microsoft passive DNS and TI graph

FreemiumWebAPI
IN
OUT
Mnemonic ARGUS icon

Mnemonic ARGUS

Mnemonic passive DNS and TI platform

FreemiumWebAPI
IN
OUT
Multi-RBL Check icon

Multi-RBL Check

Free multi-DNSBL and FCrDNS check for mail servers

FreeWeb
IN
OUT
NVD icon

NVD

the U.S. National Vulnerability Database for CVEs, CPEs, CVSS scores, and ref

FreeWeb
IN+1
OUT
NerdyData icon

NerdyData

a search engine for website source code, technologies, tracking IDs, and expo

FreemiumWeb
IN
OUT
Nikto icon

Nikto

a web server scanner for dangerous files, outdated software, and common misco

FreeOSSCLI
IN+3
OUT
Nuclei icon

Nuclei

a template-based vulnerability scanner used to detect misconfigurations and e

FreeOSSCLI
IN+3
OUT
Nuclei Templates icon

Nuclei Templates

a community template library used by Nuclei to identify vulnerabilities and m

FreeOSSCLI
IN+1
OUT
OONI Explorer icon

OONI Explorer

OONI internet censorship measurement archive

FreeOSSWebAPI
IN
OUT
OSV-Scanner icon

OSV-Scanner

a vulnerability scanner that checks dependencies against the Open Source Vuln

FreeOSSCLI
IN+1
OUT
OWASP ZAP icon

OWASP ZAP

an open-source web application security scanner and intercepting proxy for au

FreeOSSCLI
IN+3
OUT
OpenCTI icon

OpenCTI

an open-source cyber threat intelligence platform for modeling entities, rela

FreeOSSCLI
IN+2
OUT
OpenPhish icon

OpenPhish

a phishing intelligence service that detects and publishes active phishing in

FreemiumWeb
IN+2
OUT
Packet Storm Security icon

Packet Storm Security

a long-running archive of exploits, advisories, tools, and security research

FreeWeb
IN+1
OUT
PhishTank icon

PhishTank

a community phishing verification service for checking and submitting suspect

FreeWeb
IN+2
OUT
Phishstats Threat Stats icon

Phishstats Threat Stats

Free phishing-IOC community feed

FreeWeb
IN
OUT

From domain name, also find…

Report / Summary110DNS Records72URL65Subdomain63Technology Stack47Website42CVE / Vulnerability38WHOIS Data37

Find ioc (indicator of compromise) from other data

IP Address107URL90Hash (MD5/SHA)61Malware Sample31CVE / Vulnerability30Document / File16Company Name6Username6
All OSINT use cases & data types