Security tool stack
Fast pivots and checks for anything suspicious
Paste an IP, domain, URL, or file hash and jump straight to the right lookup tools. Browse a curated directory, check what a port is for, or scan a suspicious email. Free, and it runs in your browser.
IOC pivot
Look up an indicator everywhere at once
Paste an IP address, domain, URL, or file hash (MD5/SHA-1/SHA-256). We detect the type, un-defang it if needed, and give you one-click links to the tools that handle it.
Open the full reports
Defanged indicators are fine (for example bad[.]com
or hxxp://); we clean them up. Links open in a new tab.
Tool directory
A curated security tool stack
Tools we reach for, grouped by job. These open the tool's home; use the pivot above to jump straight to a specific indicator.
Port reference
What is this port for?
Search by port number or service name to see what usually runs there and whether it should be exposed to the internet.
A live scan of a host needs a server and permission to scan that host, so it isn't done from this page. To check your own exposure, use a service such as canyouseeme.org or ask us to set up a proper external scan.
Analyst toolkit
Tools for the work between the alert and the answer
Decode strings, defang and extract indicators, convert timestamps, do network math, weigh competing explanations, tune a noisy detection rule with guardrails, and look up DNS, WHOIS, DNSSEC, abuse contacts and ASNs. The search box above recognizes what you paste (an address, domain, MAC address, AS number, encoded text and more) and lists every tool that fits. Everything runs in your browser; the offline tools are blocked from making any network request.
Got a suspicious email?
Paste it into our free Email Checker and see the warning signs explained, all in your browser.