How do I check whether an IP address is malicious?

You enter the address into the IOC Radar. It shows the network operator, location, open ports, known vulnerabilities, attacks on honeypots, Spamhaus listings and malware reports, and calculates a risk score from them. For high scores, block the address and search your own logs for connections.

What does CISA KEV mean for a CVE?

The Known Exploited Vulnerabilities Catalog of the US agency CISA lists vulnerabilities for which active exploitation has been demonstrably observed. If a CVE appears there, it should be patched immediately, regardless of its CVSS score.

The Exploit Prediction Scoring System from the FIRST organisation estimates the likelihood that a vulnerability will be exploited within the next 30 days. A value of 50 % is considered very high.

Is the IOC Radar free, and are queries stored?

The Radar is free and can be used without registration. Results are cached for six hours. No personal data is stored, only a counter of queries.

IOC Radar

ENEnglish

LiveNine sources, one verdict

IOC Radar

Is it dangerous? One question, one answer.

Q: What is an IOC (Indicator of Compromise)?

An IOC is a technical trace that points to an attack, for example an attacker’s IP address, a phishing domain, the URL of a malware download, the hash of a malicious file or an exploited vulnerability. IOCs appear in firewall logs, email headers, antivirus alerts and security warnings.

Enter IP address, domain, URL, file hash or CVE-ID. The radar queries public threat intelligence sources and provides a verdict with reasons, in English.

Examples:

searches so far

actively exploited CVEs (CISA KEV)

9public sources per query

What is being checked

Five indicator types, nine sources, one verdict.

IP address

Network operator and location (RIPEstat), open ports, host vulnerabilities and tags (Shodan InternetDB), attacks against honeypots (SANS ISC DShield), block lists (Spamhaus ZEN), malware hosting (URLhaus, ThreatFox).

Domain and URL

Resolution and name servers, registration date and registrar (RDAP), phishing heuristics (age, extension, brand terms), Spamhaus domain blocklist, host context, malware URLs (URLhaus).

File hash

MD5, SHA1 or SHA256. Comparison with known legitimate files (CIRCL hashlookup, NSRL) and with malware collections (MalwareBazaar, ThreatFox), including malware family and initial detection.

CVE vulnerability

CVSS score, vector and affected products (NVD), exploitation probability (FIRST EPSS), active exploitation and ransomware link (CISA KEV), description and references.

Risk score

Each signal contributes a weighted value from 0 to 100. From 70 the indicator is considered malicious, from 40 it is considered suspicious. CVEs instead indicate patch urgency.

What is not included

No commercial feeds, no sandbox analysis, no dark web mentions of individual indicators. An inconspicuous result is not an acquittal, a conspicuous one is a reason for action.

In simple words

What is the IOC Radar?

The n'guard IOC Radar is a free threat intelligence search for indicators of compromise: IP addresses, domains, URLs, file hashes and CVE-IDs. It answers the question that arises in everyday IT life when an address is in the firewall, a link in an email or a hash in a virus scanner message: Is this dangerous and what should I do?

To do this, the radar queries up to nine public sources at the same time, weights their statements to create a risk value and explains each signal in English. It is aimed at IT managers and security officers at SMEs without their own security operations center who need a quick, well-founded initial assessment.

Limits of radar

The radar uses only free public sources and shows what they know at the time of the lookup. New or targeted attack infrastructure is initially unknown everywhere. A clean result therefore means “nothing known”, not “safe”.

FAQ

Answers to IOCs, CVEs and blocklists.

What is an IOC (Indicator of Compromise)?

A technical trace that indicates an attack: an attacker’s IP address, a phishing domain, the URL of a malware download, the hash of a malicious file, or an exploited vulnerability. IOCs show up in firewall logs, email headers, virus scanner messages, and security alerts.

How do I check if an IP address is malicious?

Enter address. The radar shows the host’s network operator, location, open ports and known vulnerabilities, whether the address has attacked honeypots, whether it is on Spamhaus blocklists and whether it is reported in malware databases. Everything creates a risk value. High values mean: block and search for connections in your own logs.

What does CISA KEV mean on a CVE?

The Known Exploited Vulnerabilities Catalog from the US agency CISA lists vulnerabilities for which active exploitation has been verifiably observed. If a CVE is there, it must be patched immediately regardless of the CVSS value. The catalog is the most reliable prioritization aid for SMBs with limited patch capacity.

What is EPSS?

FIRST’s Exploit Prediction Scoring System estimates the probability that a vulnerability will be exploited in the next 30 days. A score of 50% is very high. Combined with CVSS and KEV, it gives a realistic sense of urgency.

Is the search free, are queries saved?

Free and without registration. Results are cached for six hours so that repeated queries do not burden sources. No personal data is stored, just a counter of queries.

If the answer is “malicious”

The radar checks individual indicators. The SOC checks all your logs.

n'guard’s Managed SOC continuously matches your firewall, endpoint and cloud logs against threat intelligence and responds before a hit becomes an incident.

Get to know Managed SOC →Report an incident