IOC Inspector

About

IOC Inspector is a fast, minimalist threat intelligence aggregator for security analysts, SOC teams, and IT professionals. Paste any URL, domain, or IP address, and the extension queries multiple threat intelligence APIs in parallel — then provides one-click links to additional lookup pages.

— WHAT YOU GET —

The extension calls the following APIs in parallel and displays a verdict for each:

 - VirusTotal returns aggregated results from 90+ antivirus engines, with reputation, country, and network owner.
 - AbuseIPDB returns community-reported abuse scores, report counts, ISP, and Tor flag (IP addresses only).
 - URLScan.io returns the most recent scan, page categorization, and malicious verdict.
 - AlienVault OTX returns pulse count, threat campaigns, and ASN.
 - abuse.ch ThreatFox returns malware IOC matches, malware family, and threat type.
 - abuse.ch URLHaus returns malware distribution sites, online URL count, and blacklist hits.

For sources that don't offer a public API, the extension provides one-click links that open the relevant lookup pages in new tabs. The full list of supported third-party lookup pages is shown in the extension's settings.

— BUILT FOR DAILY SOC USE —

 - Auto-detects whether your input is an IP address or URL/domain.
 - Pre-fills with the current tab's hostname when you open the popup.
 - Right-click context menu: highlight any URL or IP and choose "Inspect with IOC Inspector".
 - Recent searches dropdown — the last 10 scans are cached so you can re-view results without burning API quota.
 - Color-coded verdict badges: clean, suspicious, or malicious.
 - One-click "Open All" button launches every manual lookup in background tabs.
 - Light and dark themes.

— EXPORT YOUR FINDINGS —

 - Copy as formatted text — useful for ticketing systems, chat tools, or note-taking apps.
 - Save as PNG — a clean screenshot of all API results.
 - Save as PDF — a print-ready report with full styling.

— PRIVACY-FIRST —

 - Bring your own API keys — no third-party server sits in the middle.
 - All processing happens locally in your browser.
 - No analytics, no telemetry, no tracking.
 - Keys are stored using Chrome's encrypted sync storage.
 - Open source on GitHub.

— FREE API KEYS —

All API keys used by this extension are free.

 - VirusTotal — 4 requests/minute, 500/day. Get a key at virustotal.com/gui/my-apikey.
 - AbuseIPDB — 1,000 IPs/day. Get a key at abuseipdb.com/account/api.
 - abuse.ch — one key works for both ThreatFox and URLHaus. Register at auth.abuse.ch.

URLScan.io and AlienVault OTX require no key.

— SUPPORTED LOOKUPS —

IPv4 addresses, hostnames, full URLs, and bare domains. The right-click context menu works on links and selected text on any page.

— BY RYMANTECH —

Built by security professionals, for security professionals.