Accepts domains, IPs, URLs, emails, phone numbers, file hashes and CIDR ranges. Defanged IOCs
like hxxp, [.] and [at] are refanged automatically.
Free threat lookup for SOC analysts
SC4N checks a suspicious domain, URL, IP address, email address, phone number, file hash or
IP range in one search and gives you a plain-English verdict with the evidence behind it. It was built for
analysts triaging phishing reports and security alerts, and anyone can use it for free without an account.
What you can check
- Domains and URLs: registration age, look-alike and brand impersonation checks, email security
(SPF, DKIM and DMARC), hosting, threat feeds, and a fresh screenshot showing where the page really lands.
- IP addresses: abuse reports, security vendor detections, proxy, VPN and Tor detection, public
blocklists, open ports and known vulnerabilities.
- Email addresses: appearances in infostealer logs and data breaches, disposable address checks
and fraud scoring.
- Phone numbers: consumer complaints about scam calls, robocalls and texts, call-back numbers used
in scams, and the line type, including internet (VoIP) numbers.
- File hashes: MD5, SHA-1 and SHA-256 lookups against known malware and sandbox results.
- IP ranges: how many addresses in a CIDR block have recent abuse reports.
How the verdict works
Each lookup gathers evidence from several threat intelligence sources and scores it. A source that
doesn't answer is never treated as clean: if too little evidence comes back, SC4N says the lookup is
inconclusive instead of guessing. Every result includes a summary and copy-ready notes for the security
team, executives and end users.
Privacy
There are no accounts. Your recent searches are kept only in your own browser. Results are held on the
server for up to 30 minutes so repeat lookups are fast, then discarded. Before an automatic page scan,
SC4N removes query strings and skips links that look like they contain an email address or a token.
Questions
- Is SC4N free?
- Yes. There is no account and no sign-up. Lookups are only rate limited to keep the service fair for everyone.
- Is it safe to check a phishing link here?
- Yes. SC4N never opens the link in your browser. It looks the address up in threat intelligence sources and, when the site hasn't been scanned recently, captures a screenshot from an isolated scanner. You can paste defanged links such as hxxp://example[.]com.
- How do I check whether a phone number is a scam?
- Enter the number in any format. US numbers work without a country code; for other countries, start with + and the country code. SC4N checks consumer complaints filed with US regulators, whether the number was given out as a call-back line in scams, and what kind of line it is, including internet (VoIP) numbers.
- What does Inconclusive mean?
- Some sources didn't respond during the lookup, so there wasn't enough evidence for a reliable verdict. Run it again shortly instead of treating the result as clean.
- Who is SC4N for?
- SOC and help desk analysts triaging phishing reports and security alerts, and anyone who wants to check a suspicious link, email address, IP address or caller before acting on it.