Triaging a Suspicious Indicator in One Command

Wed, 08 Jul 2026 00:00:00 -0700

A lot of security work starts the same way. Something hands you an indicator: an IP out of a firewall log, a file hash off an alert, a domain from an email that did not feel right. Before you can do anything with it you have to answer two questions. Is it bad, and what is it connected to?

The usual way to answer that is by hand, one tab at a time: VirusTotal, then AbuseIPDB, then a WHOIS lookup, then crt.sh, then a couple of blocklists, holding half-loaded browser tabs in your head while you try to form an opinion. It works, but it is slow and easy to do inconsistently, and it falls apart around the third indicator of a busy day.

So I built a command-line tool that does that first pass in one shot. It is called indict. You give it one indicator, it figures out the type, asks every source that fits at the same time, and hands back a single report with a verdict and the reasons under it.

Osint on Reese Gerjekian

Triaging a Suspicious Indicator in One Command