Last updated: April 30, 2026 · Publisher: RYMANTECH
IOC Inspector is a browser extension for security professionals that queries multiple threat intelligence APIs to assess the reputation of URLs, domains, and IP addresses. We do not collect, transmit, sell, or share any user data. All processing happens locally in your browser. API requests go directly from your browser to the threat intelligence providers — never through any server we operate.
The extension uses Chrome/Edge's built-in storage APIs to save the following data locally in your browser only:
|
Data |
Storage type |
Purpose |
|
API keys (VirusTotal, AbuseIPDB, abuse.ch) |
chrome.storage.sync |
Authentication when calling the respective APIs |
|
Theme preference (light/dark) |
chrome.storage.sync |
UI preference |
|
Enabled/disabled sources |
chrome.storage.sync |
UI preference |
|
Last 10 search results |
chrome.storage.local |
Quick re-access of recent lookups |
|
Last search (indicator + results) |
chrome.storage.local |
Restored when popup re-opens |
chrome.storage.sync data is synced across browsers signed into the same Google/Microsoft account by the browser itself — the publisher does not have access to it.
When you initiate a scan, the extension sends the indicator (URL/domain/IP you entered) directly to the third-party services you have enabled, using the API keys you have provided. The publisher does not operate any intermediary server. These services may have their own privacy policies:
|
Service |
Privacy policy |
|
VirusTotal |
|
|
AbuseIPDB |
|
|
URLScan.io |
|
|
AlienVault OTX |
|
|
abuse.ch (ThreatFox, URLHaus) |
For the "manual lookup" sources (Cisco Talos, IPVoid, MXToolBox, CrowdSec, RST Cloud, ThreatBook, X-Force Exchange, Scamalytics), the extension only constructs URLs — it does not send any data to those sites unless you click the "open" link, in which case your browser navigates to the lookup page like any other web link.
|
Permission |
Why it's needed |
|
storage |
Save your API keys, preferences, and recent searches locally |
|
activeTab |
Pre-fill the search box with the current tab's hostname for convenience |
|
contextMenus |
Provide the right-click "Inspect with IOC Inspector" option |
|
clipboardWrite |
Copy formatted reports to your clipboard when you click "COPY" |
|
Host permissions (6 threat intel API hosts) |
Make HTTPS requests to those specific APIs on your behalf |
IOC Inspector is a security professional tool not directed at children under 13. It does not knowingly collect data from anyone.
If we change this policy, we will update the "Last updated" date and post the new policy at the same URL. Material changes will be noted in the extension's release notes on the Chrome Web Store and Microsoft Edge Add-ons.
RYMANTECH