Indicator of compromise (IOC)
An indicator of compromise (IOC) is an observable artifact, such as a domain, URL, IP address, file hash or wallet address, that identifies malicious activity and can be blocked or searched for.
How it works
IOCs are extracted from phishing pages, malware and logs, then shared as lists or structured feeds so other teams can detect the same activity.
Their value fades quickly for domains and IPs, which is why feeds record when each indicator was first and last seen.
Example from the PhishDestroy database
- tokanim-cdn16-hk16.club: Domain report listing its indicators, first detected 2026-10-22.
- webmail-oauth.lygrunfeng.com: Domain report listing its indicators, first detected 2026-10-22.
- opensea.legal: Domain report listing its indicators, first detected 2026-10-22.
How to protect yourself
- Consume IOC feeds in your DNS filter, proxy or SIEM, and expire old entries.
- Share your own findings in a standard format (STIX, MISP) with timestamps.