Paste an IP, domain, URL, or file hash and open it in the OSINT sources below. Defanged input (1[.]2[.]3[.]4, hxxp://) is auto-cleaned. These links send the indicator to a third-party service — a deliberate click, never an automatic submission.

Enter an indicator above to activate the source links.

The analyst swiss-army knife: base64 / hex / URL / gzip decode, "Magic" auto-detect, extract IPs / URLs / emails, defang & refang, XOR, JWT decode, and hundreds more recipes. Runs entirely in your browser — the data you paste never leaves the page.

Self-hosted on this origin (v11.5.0) — served from soc.sentryglobal.net, zero external dependency, and the data you paste never leaves your browser.

Open a community malware sandbox for fast triage of commodity / already-public samples — a specimen whose hash is already in VirusTotal, or a widely-seen phishing kit. Interactive detonation, behavior, and community intel, no infrastructure to run.

⚠ Never submit client-confidential data here. Free / community-tier submissions are made PUBLIC — visible to other researchers and pushed into public threat-intel feeds. A client's file, its internal names, or the fact they are being targeted must not leave our custody. Client and confidential specimens go only to our private, isolated CAPEv2 lab — see the DFIR console for evidence-grade detonation records (verdict / IOCs / A.R.I.A analysis / chain of custody). Hands-on REMnux/FLARE reverse engineering is available on-demand internally through the DFIR team.