IOC Pivoting Tool
Paste an indicator — an IP, domain, URL, email, file hash or CVE — and jump straight to it in the threat-intel sources analysts use to pivot.
These are query links. Everything runs in your browser; nothing is sent anywhere until you click a link.
How it works & what each source shows
Paste one or more indicators. Each line is classified locally into one of: IPv4, IPv6, domain, URL, email, MD5/SHA-1/SHA-256 hash or CVE ID. For each type the tool builds direct query links to reputable sources that genuinely support that indicator type — the link text names the source and a short note says what you will find there.
Defanged input such as hxxps://evil[.]example or
user[at]evil[.]example is normalised before classifying; cards flag when this
happened so you can confirm the normalisation.
Nothing leaves your browser. The tool only constructs URLs. A request is made only when you click a link, which opens the source in a new tab. Many sources may require you to be signed in. For an email, links are offered for the address and, separately, for its domain.
This tool does not rate or score indicators itself and makes no claim about whether an indicator is malicious — it routes you to the authoritative sources so you can judge.