IOC Lookup — How to Use and Read a Hit
Use the OpenTrojan IOC Lookup tool to normalize and check IP, domain, URL and hash indicators against the intelligence store, and read what a match does and does not prove.
Quick Answer
IOC Lookup normalizes an indicator's type (IP/domain/URL/hash), searches the intelligence store, and a match is evidence to weigh — not proof — that requires further investigation.
Definition
IOC Lookup classifies an indicator and searches OpenTrojan intelligence for records mentioning it, returning matched entities and provenance.
What it is
IOC Lookup (/tools/ioc/) accepts an indicator (IP, domain, URL, or file hash), normalizes its type, and searches the intelligence store for related records.
How to use
- Open
/tools/ioc/. - Paste one indicator (or several, one per line).
- Select the detected type if ambiguous, run the lookup.
What to read
- Matched records — entities (malware, CVE, campaign) that mention the indicator, with source and confidence.
- Type normalization — whether the tool classified your input as ip / domain / url / hash.
- Provenance — where the match came from, so you can verify it.
Interpretation
A match means the indicator appears in an intelligence record — it is corroborating evidence you must weigh, not proof of compromise. Absence of a match means no known record here, which is not a clean bill. Always combine a hit with your own logs and context.
Limitations
- Coverage reflects the synced intelligence set, not the entire internet.
- A hash lookup only confirms a known association; it cannot tell you what running the file would do in your environment.
Privacy
Indicators are sent to the API for lookup and may be indexed as lookup activity; raw input is not placed in URLs or history. For fully offline hashing, use the local Hash Checker instead.
Next steps
- Deeper on indicators → Analyze indicators of compromise.
- Interpret output precisely → How to interpret IOC Lookup results.
References
Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.