What kinds of indicators can I check?

IPv4/IPv6 addresses, domains, URLs, email addresses and MD5/SHA-1/SHA-256 hashes. Defanged forms (e.g. evil[.]example[.]com) are normalized first.

Does no match mean the indicator is safe?

No. "No verified intelligence found" only means OpenTrojan has no known record. Absence of evidence is not evidence of safety.

Is my indicator sent anywhere?

The indicator value is parsed locally; only the lookup query is sent to OpenTrojan intelligence to return known references. Nothing is stored as a record of your query.

IOC Lookup — IP / Domain / URL / Hash

What this does

Detects indicator type and normalizes defanged forms locally.
Checks OpenTrojan intelligence for known references and related entities.
Displays "No verified intelligence found" when there is no record — with a clear caveat.

Related Knowledge

How to Interpret IOC Lookup Results — what a matching (or empty) record really means.
Analyze an Indicator — understand indicator types before you look them up.