Everything is a lookup
IPs, domains, URLs, file hashes, CVEs, and malware families — one search box, one defensible verdict, with a dossier behind every result.
For the fast answer
One indicator in. A verdict you can defend out.
Paste an IP, domain, URL, hash, CVE, or malware family and get a reproducible verdict — with the evidence, the source agreement, and a full dossier. No integration, no setup.
See who agreed, and how strongly
The source agreement shows which vendors flagged an indicator, weighted by how much each has earned trust — not a naive tally where a dozen echoing engines count as twelve opinions.
A dossier, not a data dump
Enrichment, related indicators, passive DNS, MITRE ATT&CK mapping, and an assessment written in plain language — so you understand the verdict, not just read a number.
Reproducible by design
The same evidence produces the same verdict, every time. Save it, share it, and re-derive it later — a lookup you can put in a report or defend in a review.
Run it from Claude, in full
Connect Lookup to Claude and get everything the app gives you — the same evidence, the same reproducible score, and the written assessment behind it. Sign in once, no token to copy, and your plan and limits still apply.
- IP · domain · URL · hash · CVE · malware family
- Weighted source agreement, not a vote count
- Full dossier with ATT&CK & related infrastructure
- Full parity inside Claude — sign in, no token
- Reproducible, shareable, no setup
See it on your data.
A 30-minute walkthrough on your indicators, your requirements, your controls.