Nexus8 · Indicator intelligence

IOC Intelligence

Correlated indicators of compromise from independent feeds. Identical indicators are deduplicated into a single record with every source preserved — an indicator confirmed by more than one feed is a stronger signal than one reported by a single feed, and Nexus8 surfaces that distinction instead of hiding it in a flat list.

Total indicators
185,080
Multi-source confirmed
684
0.37% of tracked indicators
Linked to a Story
463
0.25% of tracked indicators

185,080 indicators tracked, 684 confirmed by independent sources — create a free account to see the last 24 hours, or go Premium for full history.

Create free account

or sign in if you already have one

IOC Intelligence

Derived from the current feed

What makes an indicator worth investigating

Nexus8 doesn't treat every indicator as equally actionable. Recency, type, independent corroboration across sources, and whether an indicator has resurfaced in active news coverage all help separate what deserves a closer look from raw feed volume. Right now, 0.37% of tracked indicators are confirmed by two or more independent sources and 0.25% are directly tied to a Story we're actively covering.

Unlock the full feed →

Indicator types

What's actually being tracked, beyond URLs and IPs.

url
135,167
ip
4,874
domain
22,581
hash
22,458

Trending this week

Malware families with the most new indicators in the last 7 days — a raw count, not a derived trend score.

About Nexus8 IOC Intelligence. Indicators are aggregated from URLhaus, ThreatFox, AlienVault OTX and PhishTank, plus indicators extracted directly from tracked news coverage. Identical indicators reported by multiple sources are represented once, with full source provenance preserved rather than discarded during deduplication. The searchable, filterable feed is available with Premium.