Look up an indicator

Look up an IP, domain, URL, file hash or email in threat records.

How it works

Enter an IP, domain, URL, file hash (MD5/SHA-1/SHA-256) or email to look it up in known threat records. Defanged input such as hxxp://example[.]com is accepted. Private network addresses are not looked up. The same search is available over MCP as search_ioc.

curl -G "https://api.darkradar.com/api/public/v1/ioc/search" \
  -H "x-api-key: $DARKRADAR_API_KEY" \
  --data-urlencode "q=185.220.101.1"

"No record" means nothing was found in the checked sources; it does not mean the indicator is safe.