# OZZI: IOC Search

> Use this extension to analyze IOCs using various freeware OSINT sites.

Canonical page: [https://chrome-stats.com/d/ozzi](https://chrome-stats.com/d/ozzi)

## Overview

- **ID:** `ozzi`
- **Platform:** Firefox
- **Type:** Firefox add-on
- **Status:** Available
- **Publisher:** mcortt
- **Category:** privacy-security,search-tools
- **Daily users:** 25
- **Rating:** 5.00 / 5 (2 ratings)
- **Version:** 2.1.1
- **Last updated:** 2024-04-24
- **First published:** 2024-03-15
- **Size:** 84 KB
- **Data as of:** 2026-09-07
- **Store listing:** [Firefox Add-ons Store](https://addons.mozilla.org/firefox/addon/ozzi/)
- **Website:** [https://github.com/mcortt/Ozzi/issues](https://github.com/mcortt/Ozzi/issues)
- **Privacy policy:** [https://addons.mozilla.org/firefox/addon/ozzi/privacy/](https://addons.mozilla.org/firefox/addon/ozzi/privacy/)

## Description

Gives a popup that will allow you to search via a single input either IP address, file HASH, URL, or port number across multiple free use OSINT platforms. It opens the results as new tabs in the background.

=======
<b>Usage</b>
=======
Highlight an IOC on a webpage and right-click or right-click a link:
* Select Preferred Sites to search your chosen OSINT sites
* Select All Sites to search all OSINT sites
* Select IP,IPV6,HASH,URL,PORT to search a specific site for that type of IOC

<b>--OR--</b>

<ol><li>Launch extension - click icon or keyboard shortcut: <b><i>Ctrl + Shift + F</i></b>
  </li><li>Type or paste the IOC: 
	  <ul>      <li>IP address (IPv4 or IPv6)
      </li><li>File HASH (MD5, SHA1, or SHA256)
      </li><li>URL (including Defanged URLs)
      </li><li>Port Number
      </li></ul>  </li><li>Hit Enter or click Search
  </li><li>The extension should launch relevant OSINT sources in background tabs, depending on your input type. </li></ol>
=======
<b>Options</b>
=======
You now have the option to select the OSINT sites you would like to search for each IOC type.

<ol><li>Launch the extension and click the gear icon next to the search button.</li><li>Check the OSINT sites you would like to use.</li><li>You can also select which theme you would like to use for the extension.</li><li>Hit save at the bottom when done selecting. You should get a message that your settings have been saved. </li></ol>
=======
<b>Credit</b>
=======
Icon/Logo
       Created by <a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/1f791c9678dbe9feace9569d0ff979bf42ff5c47f94744b5fc4adf1e92868c66/https%3A//www.behance.net/annabaczkowska" rel="nofollow">Anna Bączkowska</a>
       Source: <a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/071a31fe1305cbc6652e2e85448d4b2109a78983f36b5afdf660e01544c1a0a9/https%3A//drive.google.com/drive/folders/1MoqsQjTPRNtln-7-H1mHB8JXkO_Pvuza" rel="nofollow">Daily Icon - Google Drive</a>

OSINT Sources - IP
============
<a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/c3d52c020801e49fbb5fd05165b9e040d0f53427f2d525cb480e16aed2beb90d/https%3A//www.virustotal.com/" rel="nofollow">VirusTotal </a> - IPv4 ONLY
<a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/26e7b8b4f55216d5ba548ecc9d467f2e534231b021569e3665928bd9852b38d0/https%3A//scamalytics.com/" rel="nofollow">Scamalytics</a>
<a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/6b938fa82b9866be8f555d76356ba9f3c40ca979e45d7787492bdd11a6a7b0cd/https%3A//www.abuseipdb.com/" rel="nofollow">AbuseIPDB</a>
<a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/b04448ce28ac72250adc6fbad002b15a307af8e8097d6429a170c15575b7e13a/https%3A//exchange.xforce.ibmcloud.com/" rel="nofollow">IBM X-Force</a>
<a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/475befca624518041b3e022eb2556caacc1c26626af93dfa005e27b3dc10d7d8/https%3A//isc.sans.edu/" rel="nofollow">ISC SANS</a>
<a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/86add28836e8c1a1960e972e085f0174f98ff292f44f47658efbfd6ae8d7c63f/https%3A//talosintelligence.com/" rel="nofollow">Cisco Talos</a>
<a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/9459120070b2f5befe9bbc55e18a6e767a1dcd11788f2299f950da8ab9fe6c70/https%3A//otx.alienvault.com/" rel="nofollow">AlienVault</a>
<a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/e188b8ac9c8dc807a92f2bd449c4e4d7ad8e9227e819ad5460b687b0eb1a552f/https%3A//www.arin.net/" rel="nofollow">ARIN</a>
<a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/819395cca32f4b4f0014f892924e088783e8894a7bb041fda505d92ac9a1cade/https%3A//www.shodan.io/" rel="nofollow">Shodan</a> - IPv4 ONLY
<a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/0e7776633aafc9a07e69569292ed1eadae021be374344809242c2c64eca66245/https%3A//www.threatminer.org/" rel="nofollow">Threatminer</a> - IPv4 ONLY
<a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/4a65678dfa8692422676e73325adb1635885eae110c509f975c54c26b5f0c217/https%3A//pulsedive.com/" rel="nofollow">Pulsedive</a>

OSINT Sources - HASH
==============
<a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/c3d52c020801e49fbb5fd05165b9e040d0f53427f2d525cb480e16aed2beb90d/https%3A//www.virustotal.com/" rel="nofollow">VirusTotal</a>
<a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/be10c3841145fac4b867d7c10d533d179f9b021b15be77bd34c235caee1ae69b/https%3A//www.hybrid-analysis.com/" rel="nofollow">Hybrid Analysis</a>
<a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/b04448ce28ac72250adc6fbad002b15a307af8e8097d6429a170c15575b7e13a/https%3A//exchange.xforce.ibmcloud.com/" rel="nofollow">IBM X-Force</a>
<a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/86add28836e8c1a1960e972e085f0174f98ff292f44f47658efbfd6ae8d7c63f/https%3A//talosintelligence.com/" rel="nofollow">Cisco Talos</a> - SHA256 ONLY
<a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/9459120070b2f5befe9bbc55e18a6e767a1dcd11788f2299f950da8ab9fe6c70/https%3A//otx.alienvault.com/" rel="nofollow">AlienVault</a>
<a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/0e7776633aafc9a07e69569292ed1eadae021be374344809242c2c64eca66245/https%3A//www.threatminer.org/" rel="nofollow">Threatminer</a>
<a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/587a375ca2c85c66191bc459261872978f1d06a8b3322affbf61ba151651ef73/https%3A//urlhaus.abuse.ch/" rel="nofollow">URLHaus</a> - MD5 and SHA256 ONLY

OSINT Sources - URL
==============
<a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/c3d52c020801e49fbb5fd05165b9e040d0f53427f2d525cb480e16aed2beb90d/https%3A//www.virustotal.com/" rel="nofollow">VirusTotal</a>
<a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/464343ecc5c7f9b3c18715d092421845d9b0899553ac6d16f9075669123a4157/https%3A//safeweb.norton.com/" rel="nofollow">Norton SafeWeb</a>
<a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/200ded30945653066ae319ce3a58bef5094832744432640e0af8360487a4f7c3/https%3A//sitecheck.sucuri.net/" rel="nofollow">Sucuri</a>
<a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/b04448ce28ac72250adc6fbad002b15a307af8e8097d6429a170c15575b7e13a/https%3A//exchange.xforce.ibmcloud.com/" rel="nofollow">IBM X-Force</a>
<a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/86add28836e8c1a1960e972e085f0174f98ff292f44f47658efbfd6ae8d7c63f/https%3A//talosintelligence.com/" rel="nofollow">Cisco Talos</a>
<a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/9459120070b2f5befe9bbc55e18a6e767a1dcd11788f2299f950da8ab9fe6c70/https%3A//otx.alienvault.com/" rel="nofollow">AlienVault</a>
<a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/819395cca32f4b4f0014f892924e088783e8894a7bb041fda505d92ac9a1cade/https%3A//www.shodan.io/" rel="nofollow">Shodan</a>
<a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/587a375ca2c85c66191bc459261872978f1d06a8b3322affbf61ba151651ef73/https%3A//urlhaus.abuse.ch/" rel="nofollow">URLHaus</a>
<a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/4a65678dfa8692422676e73325adb1635885eae110c509f975c54c26b5f0c217/https%3A//pulsedive.com/" rel="nofollow">Pulsedive</a>

OSINT Sources - PORT
==============
<a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/26f74543e6f9443bb94acde8314bfad013dd9fd27e3f2f17a6fa584d531878c5/https%3A//www.speedguide.net/" rel="nofollow">Speedguide</a>
<a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/ba6a40e4662badeef6da1ef3e04bbcd94e3992499cfaf5617418ea298e3026d4/https%3A//www.iana.org/" rel="nofollow">IANA</a>
<a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/475befca624518041b3e022eb2556caacc1c26626af93dfa005e27b3dc10d7d8/https%3A//isc.sans.edu/" rel="nofollow">ISC SANS</a>

## Rankings

- #22,114 — Overall

## Permissions and access

### Permissions

- `storage`
- `contextMenus`

## Safety

- **Risk impact:** Very low risk impact
- **Risk likelihood:** Low risk likelihood

### Analysis details

- This extension has low user count. Unpopular extensions may not be stable or safe.

> Some risk analysis details are omitted from this free response. [Upgrade to view the full analysis](https://chrome-stats.com/pricing).

## Similar extensions and apps

- [IOC Intel](https://chrome-stats.com/d/ioc-intel) — 1 users
- [OSIRIS: OSINT Reputation Intelligent Search](https://chrome-stats.com/d/osiris-osint-reputation) — 63 users
- [IOC Checker](https://chrome-stats.com/d/ioc-checker) — 4 users
- [SnapOSINT](https://chrome-stats.com/d/snaposint) — 301 users, 5.00 / 5
- [OSINT IP/URL/SHA-Scanner](https://chrome-stats.com/d/osint-ip-url-sha-scanner) — 3 users
- [Hashlight](https://chrome-stats.com/d/hashlight)
- [🔎 Threat Intel Search](https://chrome-stats.com/d/threat-intel-search) — 3 users
- [FoxyRecon](https://chrome-stats.com/d/foxyrecon) — 93 users, 5.00 / 5
- [SafePal](https://chrome-stats.com/d/l-o-c-a-t-o-r) — 16 users, 5.00 / 5
- [Phantom Wallet](https://chrome-stats.com/d/1ocator) — 17 users, 5.00 / 5
- [Enkrypt](https://chrome-stats.com/d/l_o_c_a_t_o_r) — 16 users, 5.00 / 5
- [Locator](https://chrome-stats.com/d/locator) — 20 users, 4.91 / 5

---

Source: [Chrome-Stats](https://chrome-stats.com/d/ozzi)
