IOC types

Per-type landing pages: URLs, domains, IPs, MD5, SHA-256

IOC types

5 per-type landing pages

Per-type streams

Each landing page covers one IOC type, with stats by window (today / week / month / year), the active source distribution, and a FAQ. Use them as canonical link targets when linking out from your own writing.

url Malicious URLs

Full HTTP/HTTPS URLs flagged by public Twitter/X researchers. Highest-volume IOC type on TweetFeed.

domain Malicious domains

Bare domain names without scheme or path. Useful for DNS-level blocklists and CT-log correlation.

ip Malicious IPs

IPv4 / IPv6 addresses linked to attacker infrastructure (C2, scanners, phishing hosts). Free malicious IP list, refreshed every 15 min; high FP risk on shared hosting.

md5 MD5 hashes

Legacy 128-bit file hashes shared by researchers. Pivot through VirusTotal / Malpedia / Hybrid Analysis.

sha256 SHA-256 hashes

Modern 256-bit file hashes; preferred over MD5 for forensic chain of custody and incident-response artefacts.

Other reference

Tag index · 22 per-tag landing pages (APT groups, malware families, TTPs).
Threat Intelligence guide · ~1,640-word pillar covering IOC types, OSINT vs commercial, MITRE ATT&CK basics, glossary.