Investigating and Analysing an IOC

The difference between a contained incident and a full-scale crisis often boils down to how fast and accurately these signals are recognized.

In cybersecurity mastering IOCs is about turning the attacker's own traces into your earliest, most powerful warning system.

Recognizing an Indicator of Compromise is only the first step. The real skill lies in knowing how to investigate it, you need a clear, repeatable process for verifying the IOC's authenticity and determining the true scope of the compromise.

In the sections that follow, I'll walk you through exactly how to do this, step by step, so you can turn raw indicators into actionable intelligence and respond with precision instead of panic.

Here is a scenario that ties everything together:

A phishing email like what you see below has just been delivered to you, you are looking at it. The clock on a potential organization wide compromise has already started ticking. How do you investigate this to know if its malicious?

A few ways you can investigate and websites you can do this.

Copy and paste the link that came with the mail on Virustotal. What you expect is a multi-engine reputation score of which helps you decide whether the link is a real indicator of compromise. We can see four security vendors have flagged the website as malicious and we can see the IP address associated with the website which can be used to carry out more investigations.

One tool is never enough when investigating an IOC. Relying on a single source can easily lead to incomplete or incorrect conclusions, a link or file that appears clean in one tool may be flagged as malicious by others. Its best practice to always correlate findings across multiple tools and intelligence sources to form accurate judgment.

Urlscan is another tool used by SOC analyst and investigators to safely examine malicious links to see final destination after redirects and gather technical details for incident reports.

The link which came with the email has been scanned on Urlscan and has been flagged as Potentially malicious.

Next, take the IP address associated with the link over to the next tool AbuseIPDB.

This tool helps reveal to Investigator the country/location, ISP/hosting provider, type of abuse reported, recent report history and by how many sources, which helps security teams, SOC analysts check the reputation of an IP address.

It is revealed that the IP address associated with the link that came in the phishing mail has been reported 3 times from 2 distinct sources and has been associated in a brute-force and ssh attack.

Next tool for investigating an IOC is Shodan this will help gather more information and to ascertain the infrastructure behind the Indicator of Compromise and give valuable context that tools like Virustotal or AbuseIPDB alone may not provide.

Copy and search the IP address and Shodan checks what services and ports are open on the suspicious IP address and discover the organisation, location and hosting provider behind an IP address.

An example in an investigation, you have a suspicious IP from a phishing campaign or unusual login. You search it on Shodan and discover it is running an open RDP port, It has an outdated version of a web server with known vulnerabilities and it is located in a specific country and hosted by a particular provider.

Domaintools is another one used by large enterprises, banks, and cybersecurity teams, key claims from their materials include visibility into 97 percent of the internet, of the largest passive DNS data bases, and 20+ years of historical records. Domaintools shows more details that can be used in contacting the engineer that created the IP address if it was connected to a malicious activity.

Scamalytics is another tool and i use this to particularly know if an IP address is a VPN, or proxy, Tor exit node, or known datacenter.

How it works: Enter an IP address on the site and it returns a risk score plus supporting details (proxy/VPN detection, country, ASN, etc.). Higher scores indicate greater likelihood that the IP is associated with fraudulent or high-risk activity.

I have been pwned is a tool to check whether an email address or password has appeared in known data breaches. What to do if caught in a breach? Go to the official site enter the email address you want to check. If it shows up in one or more breaches, the site will list the breach name(s) and the types of data that were exposed (email, password, name, phone, etc.). Recommended course of actions if you affected by a breach Change the password for that account (and any other accounts where you reused the same password) immediately. Enable two-factor authentication (2FA) wherever possible. Use a unique, strong password for every important account (a password manager helps a lot). Monitor the affected accounts for unusual activity. If the breach included financial or identity data, consider extra vigilance.

Mxtoolbox is used for scanning email addresses particularly custom email addresses and it checks if the server or domain is blacklisted and investigating spam. No DMARC record found means there is no encryption on the email address.

Note: Malicious links are frequently disguised using URL shorteners. It's important to remain cautious of shortened links, which brings us to the next tool commonly used by security analysts to expand and unmask them.

Use CheckShortURL to unmask any shortened link before starting your analysis and investigations.

In conclusion, today's threat landscape, staying ahead of cyber risks requires the right set of practical tools. From assessing IP reputation and fraud risk each of these resources plays a vital role in a security analyst's toolkit. Used together, they enable faster investigation, better threat detection, and stronger defensive decision-making. Developing the habit of leveraging these free, accessible tools is a simple yet powerful step toward improving both personal and organizational security posture.

Disclaimer

All information and tools discussed here are provided strictly for educational and informational purposes only. They are intended to help users better understand cybersecurity concepts and defensive practices. No content should be interpreted as encouragement or guidance for any illegal, unethical, or malicious activity.