← APTtrail Recent activity

Search indicators

An alert fired and you have a domain, an address or a hash. This checks it against 171,846 indicators, each one attributed to an actor and carrying the report that published it.

defanged input is fine

How this works

Indicators are sharded by sha256 of their canonical form — lowercased, and without the :port on an IPv4. Your browser computes that hash locally and fetches the one shard of 256 that could hold it, about 178 KB. Nothing you type leaves your machine: there is no server here to send it to, and no log of it anywhere.

The same lookup from a shell, if you would rather script it:

# canonical form: lowercase, no port on an IPv4
IOC=evil.example
shard=$(printf %s "$IOC" | sha256sum | cut -c1-2)
curl -s https://trilwu.github.io/apttrail/by-indicator/$shard.json | jq --arg v "$IOC" '.[$v]'

A miss means the indicator is not in this feed. It does not mean the indicator is safe — this is one corpus of historical APT reporting, not a verdict service.