Lion Cipher Lab
Research an indicator (IP, domain, or hash) like a threat-intel analyst
- Threat Intel Analyst
- Beginner
- ~30 min
- Free · no account required
Why it matters
Sooner or later every defender is handed a clue and asked "should we worry about this?" — an IP address that kept trying to log in, a domain a colleague was about to click, a hash of a file that landed in someone's downloads. That clue is called an indicator of compromise, or IOC, and turning it into a judgement is the daily work of cyber threat intelligence (CTI). The good news is that the first pass costs nothing: free public tools will tell you who owns an address, whether the security community has flagged a file or site as malicious, and whether an IP has been reported for abuse. The…
What you'll learn
- what an IOC is
- WHOIS lookups
- reputation checks (VirusTotal, AbuseIPDB)
- weighing source reliability
- OSINT hygiene (research, don't interact)
Steps in this lab
- What an indicator (IOC) actually is
- The one rule that matters: research it, don't interact with it
- Who owns it? WHOIS for domains and IPs
- Has the community flagged it? Search VirusTotal
- Is this IP reported for abuse? Check AbuseIPDB
- Put it together: weigh the sources, don't jump to conclusions
- Why this small skill is the whole job in miniature