Multi-source threat intel for IPs, domains, URLs & hashes.

Self-hostable IOC checker. Query 15 threat-intel sources in one shot, from a CLI, an HTTP API, or an interactive web UI. Exports to MISP and STIX 2.1.

CI License: MIT Python 3.11+ 15 providers IP / domain / URL / hash
Get started See the CLI in action
What you get

Built for triage, not for clicks.

15 providers, one query

VirusTotal, AbuseIPDB, GreyNoise, URLhaus, ThreatFox, MalwareBazaar, OTX, Shodan, IPinfo, SecurityTrails, Pulsedive, MalShare, RDAP, crt.sh and the Tor exit list. Four work without any API key.

Every IOC type

IPv4, IPv6, CIDR, domains, URLs, MD5, SHA1, SHA256. Auto-refangs evil[.]com, hxxp://, [dot] — paste straight from a threat report.

Auto-pivot

Check a domain and host-checker automatically fans out to its resolved IPs and checks those too — catching cases where the domain is "clean" but the IP is flagged.

Three surfaces

Same engine, three ways in: hostchecker check for scripts and CI, JSON HTTP API for automation, interactive web UI for live triage.

MISP & STIX export

Export to MISP event JSON (push straight into /events/add) or STIX 2.1 bundles with deterministic indicator IDs.

Self-hosted & OPSEC-first

Your targets never leave your machine. Local allowlist short-circuits internal infrastructure so it's never sent to any third party.

Sources

15 threat-intel sources, BYOK with sensible defaults.

The four ● sources work out-of-the-box without registration. The rest unlock as you add API keys — every one has a generous free tier.

tor_exit crtsh rdap ipinfo virustotal abuseipdb greynoise urlhaus threatfox malwarebazaar otx shodan securitytrails pulsedive malshare
In action

The CLI and the web UI.

Animated CLI demo
$ hostchecker check 8.8.8.8 evil[.]com bad-domain.test — colour-coded verdicts, per-provider breakdown, pivoted IPs.
host-checker web UI
The web UI: filter by verdict, sort by score, expand any IOC to see the per-provider breakdown, one-click JSON / MISP / STIX export.
Install

Up and running in under a minute.

$ git clone https://github.com/kukitzz/host-checker.git
$ cd host-checker
$ pip install -e "."
$ cp .env.example .env  # fill in any API keys you have
$ hostchecker check 8.8.8.8 evil[.]com
$ hostchecker serve     # → web UI on http://localhost:8000/
$ docker run --rm -p 8000:8000 --env-file .env \
    ghcr.io/kukitzz/host-checker:latest
# Then open http://localhost:8000/

# Or run the CLI inside the container:
$ docker run --rm --env-file .env ghcr.io/kukitzz/host-checker:latest \
    hostchecker check 8.8.8.8 evil[.]com
$ pip install ioc-hostchecker
$ hostchecker check 8.8.8.8 evil[.]com
$ hostchecker serve     # → web UI on http://localhost:8000/

Python 3.11+. All API keys (where required) are free to obtain — see the env example for links.