Frequently asked questions

Platform

Use Guardian to scan URLs, Intel to browse threat indicators, CVEs to research vulnerabilities, News to follow reporting, Investigate to look up indicators, and Campaigns to review sourced campaign intelligence. Use Public OSINT (preview) for public-profile, legal-entity and network research, plus image metadata inspection. Use Arsenal to discover security tools, compare capabilities and inspect source evidence and review labels. A listing is not a guarantee of safety; use tools only with authorization. Product availability and coverage depend on the data and services currently available.

Guardian

The public scanner supports anonymous use with a browser-generated session identifier for history. Keep that identifier private: it controls access to your anonymous history. Rate limits apply. You can create an account or sign in to keep signed-in scans in your private dashboard. Earlier anonymous history is not automatically transferred. Use Forgot password if you lose access to a password account; Google and GitHub users should use their provider. Verification emails can be requested from Profile when email delivery is configured. Your Profile page manages your name and optional professional details; Settings includes appearance, time zone, password and session controls, and account deletion.

Guardian

Guardian reports LOW, MEDIUM or HIGH risk from the available scan signals. A LOW result is not a safety guarantee. Provider verdicts can disagree or be unavailable. Nemotron assessment confidence is certainty in its assessment, not a maliciousness score; read the explanation and source evidence alongside the number.

Guardian

When enabled and available, Nemotron receives the submitted URL and available scan context, including provider verdicts, machine-learning output and relevant prior scan summaries. It returns a separate analysis, risk flags, inconsistencies and recommendation. If it fails, Guardian can still return its underlying scan result.

Guardian

Deep scanning fetches supported public webpage content and checks content signals; it does not provide full browser execution or malware sandboxing. Bulk scanning accepts up to 10 URLs per request. Recent results may be cached; use Rescan when you need a fresh check.

Privacy

Submitted URLs, results and related history are stored. Depending on the check, URLs, domains, IPs or hashes are sent to threat providers; enabled AI analysis shares scan context with NVIDIA. Do not submit private links, password resets, credentials or personal access tokens. See the Privacy Policy for details.

Privacy

History and investigation queries that use saved scans are scoped to your account or anonymous session, not exposed as another user’s history. Clearing history deletes the accessible saved scan records and their associated feedback. It does not recall data already sent to providers or automatically remove caches, operational logs or backups.

Intelligence

The pages periodically refresh available source snapshots. Source publication times, caching, rate limits and outages affect freshness. OTX and CISA report ingestion is scheduled separately, normally every 15 minutes while the worker runs; a sleeping host can pause it. A refreshed page does not mean every upstream source just published new data.

Campaigns

Incoming reports enter a private review inbox. OTX pulses are indicator collections and CISA advisories may describe vulnerabilities rather than campaigns. Only reviewed records are published as campaigns. Historical MITRE ATT&CK entries remain historical; missing actor, victim or impact information is not invented.

Investigate

You can search URLs, domains, IPs, email addresses and MD5, SHA-1 or SHA-256 hashes. Results depend on available public feed matches, reviewed campaign indicators and your own saved scans. A lookup does not automatically run a new Guardian scan. No match means no evidence was found in that coverage, not that the indicator is safe.

Investigate

Investigation reports can be downloaded as JSON, CSV, PDF or a STIX bundle. STIX export is not a hosted TAXII service. Copying an indicator or downloading a blocklist does not enforce a block on your network; apply it through your own security tools after review.

CVEs and news

CVSS describes vulnerability severity; it does not establish whether your software version is affected or your system has been exploited. Check vendor advisories and CISA known-exploited context. News summaries and external articles belong to their original publishers and can change after aggregation.

Support

Use Guardian’s feedback controls for a correct verdict, false positive or missed threat. Feedback helps research and evaluation; it does not automatically retrain a model or change a verdict. For intelligence corrections, privacy requests or security disclosures, use the Contact page.

Sign in and add a product watch on your dashboard, with an optional installed version. Tracking begins when you save. Newly stored CVEs, material source-record changes and new CISA known-exploited listings can appear as candidate matches. They do not establish that your installation is affected. Current CVE matches includes existing records. Changes stay unreviewed until you explicitly mark them reviewed; opening the dashboard does not clear them. You can save up to 20 watches and remove them at any time. This feature does not subscribe you to email.

Guardian

Use Message for suspicious text or Screenshot to upload an image and extract its text. Review and redact the extracted text before explicitly agreeing to NVIDIA analysis. These checks are separate from saved URL scans and are not stored in your dashboard or automatically used for training. They assess available text signals; they do not verify image authenticity or establish that a video is a deepfake.

CVEs and news

Open an individual CVE or news item to read its dedicated detail page and follow the original source links. Use Stored history on the feed pages to search retained news excerpts, CVEs and public indicators. Retrieval dates are shown separately from source dates; older observations do not establish current activity. The archive grows as feeds are fetched and is not a complete historical backfill. Details depend on the source data available. A news detail page is not a promise of full publisher article reproduction; consult the publisher for the complete story and the vendor advisory for patch guidance.

Open Public OSINT and choose People, Usernames, Organizations, Domains, IP addresses or Image evidence. People searches use Wikidata and Wikipedia references; usernames use GitHub, GitLab, Wikimedia and Bluesky public accounts; organizations use GLEIF and public reference records; domains use public DNS, certificate transparency and Internet Archive snapshot availability; and public IPs use RIPEstat with best-effort public Shodan InternetDB observations. These are indexed records, not live vulnerability scans. Image evidence supports local English OCR and QR/barcode decoding when installed, optional AI/public-source research, evidence connections and user-triggered map-feature checks. Reverse-image launch links can use an already-public image URL after you confirm sharing, or you can use the providers’ manual upload pages. Uploaded files here remain private. These are website launchers, not completed search results or an automatic reverse-image API. Coverage and failures are shown for each source. The case notebook keeps selected captures and cited investigator findings in page memory; export JSON to resume later. Markdown and HTML reports are downloadable, with browser printing for PDF. Search operators and external pivots are prepared locally and run only when you open their links. This is not a universal people search or access to private social accounts. Signed-in users can explicitly request optional authenticated Shodan enrichment for a public IPv4 address when configured. This sends the IP to Shodan; these results are not cached or saved to the public archive, and indexed observations do not confirm current exposure. Signed-in researchers can use Private cases to save domains or CVEs, source-reference pins and their own findings, resume work and export JSON. Cases belong only to their account; exports are unencrypted files under their control. Unlike the temporary OSINT notebook, cases are retained in the account database until removed or the account is deleted. Pinned sources are rechecked and can become unavailable when deleted or withdrawn.

No. Results remain separate source candidates. Compare original records, stable identifiers, dates and independent evidence before making a connection. The source coverage panel distinguishes no match, unavailable services and request limits. An outage or missing record does not prove that a person or account does not exist.

Upload a JPEG, PNG or WebP up to 5 MB and 20 megapixels to inspect dimensions, selected embedded metadata and a SHA-256 fingerprint. GPS extraction is off unless you explicitly enable it. Processing happens temporarily on our server without sending the image to intelligence or AI providers. This tool does not perform OCR, face recognition or deepfake detection; Guardian’s Screenshot tab is a separate text-analysis feature.

Searches are not saved to your dashboard or the public intelligence archive. Public-source responses are cached temporarily for up to ten minutes. Research notes stay in the current page’s memory and are lost when you clear or leave it unless exported. Use Export JSON to keep evidence and notes; protect exports that contain personal information or image coordinates.