Cybereinforce Threat Enforcement
Free IOC Lookup
Paste a domain or URL and see what Cybereinforce does with it: block it, warn about it, or let it open. The same threat intelligence and live phishing detection that protect our customers' browsers. Free, no signup.
One domain or URL per lookup. Defanged input such as hxxps://evil[.]com is cleaned for you.
What you get
The same intelligence that blocks phishing and malicious sites for Cybereinforce customers, one IOC at a time.
Our full threat intelligence
Every indicator our analysts, our certificate transparency watch, our registration monitoring and our customers' browsers have confirmed.
Day-zero phishing checks
Domains we haven't seen before go through the checks our browser protection runs live: brand look-alikes, newly registered domains, machine-generated names and known phishing link shapes.
Reviewed by people
Anything new goes to Cybereinforce analysts. Leave your email address and we'll send you the verdict.
Questions
What can I look up?
A domain (login-example.com) or a full URL (https://site.com/path). Defanged indicators from reports, such as hxxps://evil[.]com, are cleaned automatically. A URL on a blocked domain is reported as malicious, because Cybereinforce blocks the whole domain.
The result is wrong, or it's my company's site
Right under every result you can report a false positive, suggest a different category or ask us to block something. Cybereinforce analysts review every request and reply by email.
Why ten a day?
The lookup is built for analysts working an investigation, one indicator at a time. Ten a day keeps it free and fast for everyone. Cybereinforce customers get every check automatically, in every browser, with no limit.
What does "No detections" mean?
Our intelligence and our live checks have nothing against this domain or URL right now, so Cybereinforce lets it open. It is a data point for your investigation, not a guarantee that something is safe.
What happens to what I look up?
We keep the IOCs people look up (URLs without their query string) to improve our threat intelligence. We don't store your IP address: daily limits use a one-way code of it. If you ask for the result by email, we use your address only for what you agree to, and every email has a one-click unsubscribe link. See our privacy policy.
Protect every browser in your company
Cybereinforce checks every site your people open against this intelligence in real time and blocks phishing before a password is typed. Built for Microsoft Defender environments.
Start Free Trial How our threat intelligence works All community tools