Know what an indicator is before you touch it.
Paste a file hash, URL, domain or IP address. ThreatTrove queries every source it can reach, then folds the answers into one verdict you can act on.
try:
Recent lookups
| Indicator | Verdict | When |
|---|---|---|
| 275a01940e8e5fd860b56e7ef1f52a5ae07a1c1f0c63d7dbdd2bd2433e6d1f0f | No verdict | 4m ago |
| example.com | No verdict | 13m ago |
| 275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f | Malicious | 14m ago |
| example.com | No verdict | 15m ago |
| 275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f | Malicious | 15m ago |
| 275a01940e8e5fd860b56e7ef1f52a5ae07a1c1f0c63d7dbdd2bd2433e6d1f0f | No verdict | 15m ago |
| 4444444444444444444444444444444444444444444444444444444444444444 | No verdict | 15m ago |
| example.com | No verdict | 15m ago |
Coverage
8sources live
36lookups
11cached
15malicious
21 sources configured, 8 answering right now. Each source is weighted by how strongly it asserts a verdict; the rest activate once their API key is set. See sources.
Bulk enrichment
Drop a CSV export from any feed, a newline list, or a JSON array. Headers are auto-detected and every indicator lands in a queue you can poll from the browser or the API.
Start a bulk job