IOC Trends

Daily IOC volume for the last 30 days split by type (URL, domain, IP, SHA256, MD5), the tags with the biggest week-over-week swings, the most common TLDs among malicious domains from the last 30 days, how many IOC values seen this week are new versus previously reported, and how concentrated the feed is across the accounts producing IOCs.

Each tag's IOC count in the current 7-day window is compared to the previous 7-day window. Tags are ranked by the size of that change, positive or negative. A tag with zero IOCs in the previous window is marked as new instead of a percentage, since the percentage change would be undefined.

Over the current week, an IOC value counts as new if TweetFeed has never reported it before, and recurring if it was seen in an earlier period. A high new rate usually means fresh infrastructure; a high recurring rate means attackers are reusing existing domains, IPs, or files.

Producer concentration in the feed. It tracks active producer accounts over the last 7 and 30 days, the share of IOCs coming from the top 2 accounts (shown as a badge: green under 40%, amber between 40% and 60%, red above 60%), and the bus factor, the minimum number of accounts behind 50% of the IOCs. High concentration means the feed depends heavily on a few accounts.

Every 15 minutes, the same cadence as the rest of the TweetFeed feed.