Bulk-IOC-Scanner

Paste a list of indicators — file hashes, IPs, domains, URLs — and get them all checked against threat intelligence sources at once, with a risk score, a history you can search, and reports you can copy straight into a ticket.

It runs on your own machine. Nothing is uploaded except the indicators themselves, and files you scan are hashed locally so only the hash ever leaves your computer.

Install

Pick one of the three. All of them give you the same app at http://localhost:8000.

Option 1: Download and run

Grab the file for your system from the latest release.

Windows — download bulk-ioc-scanner-windows-x64.exe and double-click it.

Windows will warn you the app is unrecognised, because the file is not code signed. Click More info, then Run anyway.

Linux — download bulk-ioc-scanner-linux-x64, then:

chmod +x bulk-ioc-scanner-linux-x64
./bulk-ioc-scanner-linux-x64

macOS — there is no prebuilt Mac app; use pipx or Docker instead.

Option 2: Install with pipx or uvx

Needs Python 3.11 or newer.

pipx install bulk-ioc-scanner
bulk-ioc-scanner

Or run it without installing anything permanently:

uvx bulk-ioc-scanner

To update later: pipx upgrade bulk-ioc-scanner

Option 3: Docker

docker run -d --name bulk-ioc-scanner \
  -p 8000:8000 \
  -v bulk-ioc-scanner-data:/data \
  ghcr.io/hashemsalhi/bulk-ioc-scanner:latest

Then open http://localhost:8000. Your history and keys live in the bulk-ioc-scanner-data volume and survive upgrades.

Or, from a copy of this repository, docker compose up -d.

First run

1. Start it. A browser tab opens at http://localhost:8000 on its own.
2. Go to Scan, paste your indicators — one per line, or comma separated — and press Scan.
3. Results appear as they arrive. Click any row for the full per-source breakdown, tag it, add notes, or copy a formatted report.

Defanged indicators are fine: 8[.]8[.]8[.]8 and hxxps://evil[.]com are understood and cleaned up automatically.

You can also drop files in. They are hashed on your machine and only the SHA-256 is sent out — the file contents never leave.

About API keys

You do not need any API key to start. RDAP/WHOIS works immediately and covers IPs, domains, and network ownership.

For hashes and URLs you will want at least one key. They are free, take about a minute, and go in the Settings page inside the app — there is no config file to edit.

Any source without a key is skipped. You can switch individual sources on and off on the Settings page.

Where your data is kept

Scan history and API keys go in one folder, outside the program itself, so upgrading or reinstalling never loses them:

To back up, copy bulk_ioc_scanner.db out of that folder. To start clean, delete it. To keep it somewhere else, start with bulk-ioc-scanner --data-dir "D:\cases\ioc-data".

The database contains your API keys in plain text and is created readable only by your user account. Treat a copy of it the way you would treat the keys.

On a corporate network

If your organisation routes traffic through a proxy or inspects TLS, scans will fail until it is told how to get out. Everything below can go in a .env file in your data folder, or be set as environment variables.

Behind a proxy — the standard variables are picked up automatically:

HTTPS_PROXY=http://proxy.example.corp:8080
NO_PROXY=localhost,127.0.0.1

To force one regardless of the environment, set PROXY_URL instead.

TLS inspection — if your company issues its own certificates, point the app at the CA bundle:

CA_BUNDLE=/path/to/corporate-ca.pem

If you already have REQUESTS_CA_BUNDLE, SSL_CERT_FILE, or CURL_CA_BUNDLE set for curl or pip, those are used automatically and you need to do nothing.

Slow links — raise the timeouts:

REQUEST_TIMEOUT_SECONDS=60
CONNECT_TIMEOUT_SECONDS=20

Rate limits are handled for you: a source that answers "too many requests" is retried with a growing delay and then paced more slowly, and a source that is down or blocked only costs you its own column — the rest of the scan finishes normally.

As a last resort you can set INSECURE_SKIP_VERIFY=true to stop checking certificates. Prefer CA_BUNDLE; skipping verification means you cannot tell your proxy from an attacker.

Troubleshooting

Still stuck? Open an issue with what you ran and what you saw.

Options

bulk-ioc-scanner [--host HOST] [--port PORT] [--no-browser]
                 [--data-dir PATH] [--log-level LEVEL] [--version]

--host 0.0.0.0 makes it reachable from other machines. There is no login screen, so only do that on a network you trust.

Uninstall

Contributing

Working on the code is covered in DEVELOPMENT.md.

License

MIT.