IOC Trends

Daily IOC volume for the last 30 days split by type (URL, domain, IP, SHA256, MD5), the tags with the biggest week-over-week swings, the most common TLDs among malicious domains from the last 30 days, and how many IOC values seen this week are new versus previously reported.

Each tag's IOC count in the current 7-day window is compared to the previous 7-day window. Tags are ranked by the size of that change, positive or negative. A tag with zero IOCs in the previous window is marked as new instead of a percentage, since the percentage change would be undefined.

Over the current week, an IOC value counts as new if TweetFeed has never reported it before, and recurring if it was seen in an earlier period. A high new rate usually means fresh infrastructure; a high recurring rate means attackers are reusing existing domains, IPs, or files.

Every 15 minutes, the same cadence as the rest of the TweetFeed feed.