IP threat lookup

Threat Lookup is a tool to investigate indicators of compromise. You enter an IP, domain, URL or hash and instantly get context, a malicious score and MITRE ATT&CK mapping.

You can look up IP addresses, domains, URLs and file hashes and see which feeds and sources flagged them as malicious.

The malicious score summarises how many independent sources consider an indicator harmful, helping you prioritise real threats quickly.

Yes. Every indicator is mapped to the relevant MITRE ATT&CK tactics and techniques, so you understand how it fits the broader attack.

Start for free on the Q-Feeds Threat Intelligence Portal, then upgrade to Plus or Premium for deeper access and faster intelligence.

Enter any IP address, domain or URL in Threat Lookup to see its reputation, a malicious score and MITRE ATT&CK context drawn from our multi-source IOC database.

Yes. Each indicator shows its linked indicators, such as the IP a domain resolves to, the reverse DNS name of an IP, the host behind a URL, other hashes of the same file, the URL that delivered a payload and samples of the same malware family. The relationship graph draws these links around the indicator: expand any node to follow the chain, filter by DNS, payload or STIX relationships, or open a node as its own indicator.

Threat Lookup is built for investigation: it explains why an indicator is malicious, how it maps to MITRE ATT&CK and what it is connected to. Searching your own historical logs for those indicators happens in your SIEM, where Q-Feeds indicators can be loaded into Splunk, Microsoft Sentinel, Wazuh and others.

Yes. The Malware activity page ranks malware families by the new indicators we saw this week and flags families that have gone quiet. Each family has its own page with a 90-day trend, its latest indicators and the threat actors linked to it. The Threat actors page shows recent activity per group, with the techniques and campaigns MITRE ATT&CK lists for it. Both are included with Plus and Premium.