Nexus8 · Indicator intelligence

IOC Intelligence

Premium

Correlated indicators of compromise from independent feeds. Identical indicators are deduplicated into a single record with every source preserved — an indicator confirmed by more than one feed is a stronger signal than one reported by a single feed, and Nexus8 surfaces that distinction instead of hiding it in a flat list.

Total indicators
114,041
Linked to a Story
339
0.30% of tracked indicators
URLs
102,965
IPs
1,864

114,041 indicators tracked, 77 confirmed by independent sources — search, filter and investigate the full feed with Premium.

Upgrade to Premium

or sign in if you already have an account

IOC Intelligence

Derived from the current feed

Source corroboration

Most indicators are reported by a single feed. The shares below are the percentage of tracked indicators each source contributes to — an indicator can be reported by more than one source, so the values don't sum to 100%.

PhishTank
66%
URLhaus
24%
News extraction
6%
ThreatFox
5%
AlienVault OTX
0%

What makes an indicator worth investigating

Nexus8 doesn't treat every indicator as equally actionable. Recency, type, independent corroboration across sources, and whether an indicator has resurfaced in active news coverage all help separate what deserves a closer look from raw feed volume. Right now, 0.07% of tracked indicators are confirmed by two or more independent sources and 0.30% are directly tied to a Story we're actively covering.

Unlock the full feed →
About Nexus8 IOC Intelligence. Indicators are aggregated from URLhaus, ThreatFox, AlienVault OTX and PhishTank, plus indicators extracted directly from tracked news coverage. Identical indicators reported by multiple sources are represented once, with full source provenance preserved rather than discarded during deduplication. The searchable, filterable feed is available with Premium.