dl.example.test198.51.100.242auth.example.org2001:db8::e4f203.0.113.2062001:db8::49ecdn.example.com192.0.2.41192.0.2.144img.example.com192.0.2.194cdn.example.net192.0.2.154mail.example.testsso.example.testsso.example.org198.51.100.188login.example.test203.0.113.208192.0.2.86198.51.100.191sso.example.testdl.example.test198.51.100.242auth.example.org2001:db8::e4f203.0.113.2062001:db8::49ecdn.example.com192.0.2.41192.0.2.144img.example.com192.0.2.194cdn.example.net192.0.2.154mail.example.testsso.example.testsso.example.org198.51.100.188login.example.test203.0.113.208192.0.2.86198.51.100.191sso.example.test

img.example.net198.51.100.1792001:db8::357203.0.113.160sso.example.net198.51.100.229198.51.100.91192.0.2.7login.example.com198.51.100.205192.0.2.95sso.corp.examplemail.example.comupdate.example.orgdl.corp.example203.0.113.27198.51.100.163198.51.100.57198.51.100.103cdn.example.test198.51.100.25192.0.2.246img.example.net198.51.100.1792001:db8::357203.0.113.160sso.example.net198.51.100.229198.51.100.91192.0.2.7login.example.com198.51.100.205192.0.2.95sso.corp.examplemail.example.comupdate.example.orgdl.corp.example203.0.113.27198.51.100.163198.51.100.57198.51.100.103cdn.example.test198.51.100.25192.0.2.246

198.51.100.49203.0.113.60update.example.com192.0.2.14files.example.commail.example.com203.0.113.90login.example.net203.0.113.185203.0.113.612001:db8::b6cdn.example.net2001:db8::27dns1.example.net198.51.100.71203.0.113.195ns1.example.net192.0.2.132update.corp.example192.0.2.7vpn.example.test192.0.2.80198.51.100.49203.0.113.60update.example.com192.0.2.14files.example.commail.example.com203.0.113.90login.example.net203.0.113.185203.0.113.612001:db8::b6cdn.example.net2001:db8::27dns1.example.net198.51.100.71203.0.113.195ns1.example.net192.0.2.132update.corp.example192.0.2.7vpn.example.test192.0.2.80

api.example.org203.0.113.254203.0.113.150203.0.113.100dl.corp.example198.51.100.242203.0.113.122001:db8::3d4auth.example.org198.51.100.1992001:db8::97d203.0.113.18files.example.net2001:db8::e0f203.0.113.208198.51.100.166dl.corp.example192.0.2.131198.51.100.26198.51.100.141192.0.2.132203.0.113.153api.example.org203.0.113.254203.0.113.150203.0.113.100dl.corp.example198.51.100.242203.0.113.122001:db8::3d4auth.example.org198.51.100.1992001:db8::97d203.0.113.18files.example.net2001:db8::e0f203.0.113.208198.51.100.166dl.corp.example192.0.2.131198.51.100.26198.51.100.141192.0.2.132203.0.113.153

198.51.100.32203.0.113.94198.51.100.1files.corp.example203.0.113.122auth.corp.example192.0.2.147cdn.example.testlogin.corp.example203.0.113.15auth.example.test203.0.113.21login.example.test203.0.113.146sso.corp.example203.0.113.209auth.example.com2001:db8::ac5198.51.100.218203.0.113.238203.0.113.15203.0.113.181198.51.100.32203.0.113.94198.51.100.1files.corp.example203.0.113.122auth.corp.example192.0.2.147cdn.example.testlogin.corp.example203.0.113.15auth.example.test203.0.113.21login.example.test203.0.113.146sso.corp.example203.0.113.209auth.example.com2001:db8::ac5198.51.100.218203.0.113.238203.0.113.15203.0.113.181

198.51.100.89files.example.com2001:db8::47f2001:db8::438198.51.100.43203.0.113.251vpn.corp.exampleapi.example.com192.0.2.219203.0.113.173198.51.100.113dl.example.org2001:db8::a9files.corp.exampleimg.example.org192.0.2.115203.0.113.26update.example.comfiles.example.netimg.example.com198.51.100.221198.51.100.200198.51.100.89files.example.com2001:db8::47f2001:db8::438198.51.100.43203.0.113.251vpn.corp.exampleapi.example.com192.0.2.219203.0.113.173198.51.100.113dl.example.org2001:db8::a9files.corp.exampleimg.example.org192.0.2.115203.0.113.26update.example.comfiles.example.netimg.example.com198.51.100.221198.51.100.200

files.corp.example2001:db8::958192.0.2.122mail.example.com2001:db8::8fc198.51.100.159192.0.2.151203.0.113.219198.51.100.27203.0.113.222sso.example.net192.0.2.126sso.corp.examplemail.example.com198.51.100.6dl.corp.example192.0.2.148203.0.113.106ns1.example.test2001:db8::a3b192.0.2.1462001:db8::48dfiles.corp.example2001:db8::958192.0.2.122mail.example.com2001:db8::8fc198.51.100.159192.0.2.151203.0.113.219198.51.100.27203.0.113.222sso.example.net192.0.2.126sso.corp.examplemail.example.com198.51.100.6dl.corp.example192.0.2.148203.0.113.106ns1.example.test2001:db8::a3b192.0.2.1462001:db8::48d

203.0.113.221198.51.100.195vpn.example.com198.51.100.224203.0.113.114198.51.100.50login.example.testfiles.example.netmail.corp.example192.0.2.81203.0.113.60cdn.example.comcdn.example.test192.0.2.1562001:db8::273img.example.comvpn.corp.example192.0.2.64203.0.113.98sso.example.orgsso.example.test2001:db8::1ed203.0.113.221198.51.100.195vpn.example.com198.51.100.224203.0.113.114198.51.100.50login.example.testfiles.example.netmail.corp.example192.0.2.81203.0.113.60cdn.example.comcdn.example.test192.0.2.1562001:db8::273img.example.comvpn.corp.example192.0.2.64203.0.113.98sso.example.orgsso.example.test2001:db8::1ed

192.0.2.246img.example.comfiles.example.org2001:db8::6632001:db8::e092001:db8::a97192.0.2.49198.51.100.50dl.example.net198.51.100.104203.0.113.137update.example.com192.0.2.61update.example.net192.0.2.169203.0.113.192ns1.example.com192.0.2.194sso.example.net198.51.100.169ns1.example.netdl.example.com192.0.2.246img.example.comfiles.example.org2001:db8::6632001:db8::e092001:db8::a97192.0.2.49198.51.100.50dl.example.net198.51.100.104203.0.113.137update.example.com192.0.2.61update.example.net192.0.2.169203.0.113.192ns1.example.com192.0.2.194sso.example.net198.51.100.169ns1.example.netdl.example.com

Threat intelligence workbench

Investigate any IP, domain or URL in one lookup.

VirusTotal, AbuseIPDB, GreyNoise, who.is and more, queried together with your own API keys. Every score shows the evidence behind it.

Access is by invitation. See how it works

185.220.101.4

IP address 3 of 3 sources answered

Example

Suspicious

Flagged by all three sources. Each line shows what that source found.

VirusTotal11 of 94 engines flagged
AbuseIPDBAbuse confidence 87%
IP2ProxyTor exit node

How it works

Indicator in. Verdict out.

Input

evil-login.exampleDomain

Pasted as Evil-Login[.]Example.

Sources in parallel

VirusTotalAnswered
AbuseIPDBIP only
IP2ProxyIP only
GreyNoiseIP only
AlienVault OTXAnswered
who.isAnswered

Verdict

Suspicious

Medium confidence

VirusTotal 4 of 94 engines flagged it

Coverage

What you can check.

Each source covers different indicators. Indicia only asks the ones that apply.

Indicator	VirusTotal	AbuseIPDB	IP2Proxy	GreyNoise	AlienVault OTX	who.is
IP addressIPv4 IPv6	Supported	Supported	Supported	Supported	Supported	Not supported
Domain	Supported	Not supported	Not supported	Not supported	Supported	Supported
URL	Supported	Not supported	Not supported	Not supported	Supported	Not supported
File hashMD5 SHA-1 SHA-256	Supported	Not supported	Not supported	Not supported	Supported	Not supported

Your keys

Your API keys stay yours.

Indicia runs every lookup with your own provider keys. They never come back to the browser.

Encrypted with AES-256-GCM on the server
Shown masked, never returned in full
Used only for your own lookups
Deleting a key removes it straight away

Provider keys

Example

VirusTotal••••••••••••a92fConnected
AbuseIPDB••••••••••••7c1eConnected
IP2ProxyNot configured
GreyNoiseNot configured
AlienVault OTXNot configured
who.isNot configured

Decrypted only on the server, only for your lookups.

Sources

More sources on the way.

Five connected today, with more planned.

VirusTotalConnected
AbuseIPDBConnected
IP2ProxyConnected
GreyNoiseConnected
AlienVault OTXConnected
who.isConnected

ShodanNext
URLScanPlanned

Questions

Good to know.

Something else? Contact us.

Do you store my API keys?

Yes, so lookups work without re-entering them. Each key is encrypted on the server, only its last four characters are kept readable for display, and it's never sent back to your browser. Deleting a key removes it straight away.

Which sources are supported?

VirusTotal, AbuseIPDB, IP2Proxy, GreyNoise, AlienVault OTX and who.is, each with your own key. You can start with any one of them. Sources you haven't connected show as not configured rather than being skipped silently.

How do I get access?

Accounts are by invitation. Request access and we'll set one up for you.

Is my lookup data shared with anyone?

Your lookups, notes and watchlist are visible only to you. To check an indicator, Indicia sends it to the sources you've connected, using your key. Lookups are deleted after 7 days, and you can delete them sooner. Notes and your watchlist stay until you delete them.

What if a source is down or rate-limited?

The lookup still completes with the sources that answered, and the one that didn't says why: timed out, rate limited, key rejected or unavailable. A failed source is never counted as clean.