As a SOC analyst, I’ve often found myself drowning in a sea of logs and alerts, constantly sifting through data to identify potential threats. The manual process of extracting Indicators of Compromise (IoCs) and cross-referencing them with threat intelligence sources can be incredibly time-consuming and prone to human error. It’s a challenge many security professionals face daily.

To solve this, I built ThreatLens — an open-source Chrome extension designed to automate IoC detection and reputation scanning directly in your browser.

What is ThreatLens?

ThreatLens is a powerful open-source Chrome extension that automatically highlights and analyzes potential IoCs directly within any webpage you’re viewing. It’s built with the needs of SOC analysts and security professionals in mind, providing immediate context and reputation data for suspicious elements.

The goal was simple: build a tool that gives you instant threat intelligence without breaking your workflow.

Key Features That Make a Difference

Real-time IoC Detection: Automatically identifies IPv4, IPv6, domains, and URLs on any webpage.

AbuseIPDB Integration: Get reputation scores, ISP, and country data with a single click.

Bulk Scanning: Paste a list of indicators in the options page to scan them all at once.

De-masking Support: Automatically handles obfuscated indicators like [.].

Scope Control: Configure and run only on selected sites or exclude specific domains to fit your workflow.

Non-destructive UI: The extension injects subtle badges (🔍) next to detected indicators. This is implemented without affecting the layout or inputs of the website.

Privacy Focused: No telemetry or tracking. Data is only sent to AbuseIPDB when you trigger a scan.

How It Works?

ThreatLens operates with a clear, privacy-focused methodology, ensuring you get the intelligence you need without compromising your data.

• Non-destructive UI: Injects small 🔍 badges next to detected indicators without breaking page layout.
• Scope Check: Runs only on sites allowed by your allowlist/blocklist settings.
• DOM Scan: Uses TreeWalker to scan visible text while skipping scripts, inputs, and editable fields.
• Regex Detection: Identifies IPv4, IPv6, domains, and URLs using pattern matching.
• Badge Injection: Detected indicators are wrapped in a <span> with a 🔍 button.
• Reputation Lookup: Clicking 🔍 resolves domains via Google DNS-over-HTTPS and queries AbuseIPDB.
• Result Display: Shows a colored badge (🟢 safe / 🔴 danger) based on abuse confidence score.

Getting Started with ThreatLens

Ready to enhance your threat analysis workflow? Getting started is straightforward:

1. Installation: Install ThreatLens directly from the Chrome Web Store. You can find it here: ThreatLens on Chrome Web Store
2. API Key: Obtain a free AbuseIPDB v2 API key from abuseipdb.com. The free tier offers 1,000 checks per day, which is typically sufficient for most analysts’ daily needs.
3. Configuration: Open the extension options page (right-click the ThreatLens icon → Options) to enter your API key and configure your preferred scope settings (allowlist/blocklist). It’s quick and easy to tailor to your environment.

Privacy and Trust: Built with Security in Mind

ThreatLens is designed with a strong commitment to user privacy. No data is sent anywhere except to AbuseIPDB for explicit lookups you trigger and to Google DNS for domain resolution. There is absolutely no telemetry, no tracking, and no hidden data collection. You can use ThreatLens with confidence, knowing your browsing activity remains private.

Conclusion

ThreatLens is designed to be that tool, transforming the way you interact with IoCs online. By automating detection and integrating with a reputable threat intelligence source, it lets you focus on deeper analysis and higher-priority tasks, ultimately strengthening your defensive posture.

ThreatLens is also an open-source project, and contributions are always welcome. Whether it’s new features, improvements, or ideas, your input helps make the tool better for everyone.

Give it a try and see the difference it can make in your daily workflow. Your feedback is invaluable as we continue to evolve and improve ThreatLens for the security community.

Thanks for reading! Feel free to share your thoughts or any feedback you have — I’d love to hear from you!