An Indicator of Compromise (IOC) is a piece of forensic evidence that something malicious happened, or is about to. It could be a malicious IP address, a domain used for phishing, a file hash matching known malware, or a URL serving an exploit kit. On their own, IOCs are just data points. Their value comes from being collected, shared, and matched against activity in your own environment.
Common types of IOCs
- Network indicators: malicious IPs, C2 (command-and-control) domains, suspicious URLs.
- File indicators: hashes (MD5, SHA-1, SHA-256) that fingerprint known malware samples.
- Host indicators: registry keys, file paths, or process names associated with a specific attack toolkit.
- Email indicators: sender addresses, subject patterns, or attachment names tied to phishing campaigns.
Where the data comes from
No single organization sees the whole picture, which is why IOC sharing exists. Projects like URLhaus and ThreatFox (both run by abuse.ch) crowdsource malicious URLs and IOCs from researchers worldwide and publish them as free, structured feeds. AbuseIPDB does the same for abusive IP addresses, built from reports submitted by network operators and security teams reporting attacks against their own infrastructure. Pulling from several independent feeds gives broader, faster coverage than any single source alone.
From feed to signal
A raw IOC feed is just a list. Turning it into something actionable means fetching it on a schedule, deduplicating against what you already have, and surfacing new entries in a way a human can actually scan. That is the pipeline behind our live signal log: a scheduled fetcher pulls from URLhaus, ThreatFox, AbuseIPDB, and AlienVault OTX, and new indicators land in the dashboard as they are published.
Limitations worth knowing
IOC feeds are reactive by nature. An indicator usually only exists because someone already observed the malicious activity elsewhere. They also age quickly: attackers rotate infrastructure, so an IP flagged last month may be clean today and a different IP may now be doing the damage. That is why freshness matters more than volume, and why a feed with no update timestamp is far less useful than one you can see is actively syncing.