Below is a list of publicly available resources I have experience with. This list is certainly not exhaustive. Also note that IOCs can be malicious in the absence of hits/reports at these sources. However, they can help you build context while researching or performing analysis.
## General IOC validation
Resources will be presented in Chrome’s saved search format, where the search term is replaced with `%s`.
| Resource | File hash | Domain | IP address | URL | Notes | Search Format | API Documentation |
| ------------------------------------------------ | --------- | ------ | ---------- | --- | -------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------ | ---------------------------------------------- |
| [AbuseIPDB](https://www.abuseipdb.com) | ❌ | ✅ | ✅ | ❌ | | `https://www.abuseipdb.com/check/%s` | https://docs.abuseipdb.com/ |
| [VirusTotal](https://virustotal.com) | ✅ | ✅ | ✅ | ❌ | | `https://www.virustotal.com/gui/search/%s` | https://docs.virustotal.com/reference/overview |
| [Spur Context API](https://spur.us/context-api/) | ❌ | ❌ | ✅ | ❌ | Can identify residential/anonymizing proxy and VPN use. Free tier does not include API keys, but can be used to search in the browser. | `https://app.spur.us/context?q=%s` | https://docs.spur.us/context-api |
| [URLScan](https://urlscan.io/search/) | ❌ | ✅ | ✅ | ✅ | Searches can show full HTTP request chains, redirects, and other behaviors related to a URL. | `https://urlscan.io/search/#%s` | https://urlscan.io/docs/api/ |
## Network exposure
The following tools can be used to assess network exposure, such as ports or services open to the internet.
| Resource | Search Format | API Documentation |
| ---------------------------------- | ----------------------------------- | ---------------------------- |
| [Shodan](https://shodan.io) | `https://www.shodan.io/host/%s` | https://developer.shodan.io/ |
| [Censys](https://search.censys.io) | `https://search.censys.io/hosts/%s` | https://search.censys.io/api |
## Other network tools
[Hurricane Electric BGP Toolkit](https://bgp.he.net/)