# IOC Feeds

URL: https://www.deepinfo.com/platform/cti/ioc-feeds/

## Indicators Your Detection Stack Can Act On.

An indicator of compromise is an observable, such as a domain, an IP address or an email address, that points to malicious activity. Much of what the Deepinfo Platform already structures is exactly that.

IOC Feeds bring those indicators, with context such as the CVEs active threat actors use, to the tools that act on them. Which indicators, and how your team receives them, is scoped with you.

[Talk to us about feeds](https://www.deepinfo.com/contact/) [Request demo](https://www.deepinfo.com/request-demo/)

### Indicators From Data the Platform Already Holds.

Indicators feed blocking and hunting. Context tells an analyst how much weight an indicator deserves. All the sources below sit behind one API and one key.

- **Lookalike domains · Indicator**: `POST /brp/fraudulent-domains/search` · Domains matched to your brand keywords by Brand Risk Protection, each with its DNS, SSL, WHOIS and web data history
- **Dark web records · Indicator**: `POST /discovery/darkweb-search` · Email addresses, IP addresses, crypto addresses and websites extracted from dark web records, and the CVEs they mention
- **Newly registered domains · Enrichment**: `GET /feeds/daily-registered-domains` · Domains registered in the last day, delivered as a daily file
- **Actor capabilities · Context**: `POST /cti/threat-actors/search` · The CVEs and tools listed on each threat actor profile
- **Known exploited CVEs · Context**: `POST /discovery/vulnerability-search` · CVEs in the CISA KEV catalog, with the date added and the required action

Paths are relative to `https://api.deepinfo.com/v1`. Which of these your plan includes depends on your modules.

### Send Each Indicator to the Right Control.

Mail and web

#### Lookalike Domains

A domain built to look like yours belongs on the deny list of your mail gateway and web proxy while the takedown runs.

Hunting

#### Dark Web Indicators

An IP address or an email address pulled from a dark web record is a lead to search for in your logs.

Patching

#### Actor-Used CVEs

A CVE that active actors use, found on one of your assets, is a patch that should not wait for the next cycle.

Enrichment

#### New Registrations

When an unfamiliar domain turns up in your traffic, a registration from yesterday changes how an analyst reads it.

A bare IP address is a block rule. *With its record, it’s a lead.*

That address next to the dark web record it came from, or a lookalike domain next to its DNS and certificate history, is something an analyst can reason about.

Apart from the daily registration file, each source here is a searchable record rather than a bare list, so the person who acts on an indicator can check it first.

### Pull Indicators With the Filters You Already Use.

Fraudulent domain search, like most platform searches, has an export twin that returns all matching records in one response, without paging.

The filter body is the one the search already uses, so a list your analysts built in the platform becomes a scheduled pull in a few lines of code.

[Fraudulent Domain Export reference](https://docs.deepinfo.com/reference/brp/fraudulent-domain-export/)

Export lookalike domains

```bash
curl -X POST \
  "https://api.deepinfo.com/v1/brp/fraudulent-domains/search:export" \
  -H "apikey: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d @filter.json
```

### The Records Behind the Indicators.

- [Fraudulent Domain Monitoring](https://www.deepinfo.com/platform/brp/fraudulent-domain-monitoring/) (BRP): Lookalike domains matched to your brand, with evidence.
- [Threat Actor Intelligence](https://www.deepinfo.com/platform/cti/threat-actor-intelligence/) (CTI): The CVEs and tools each actor uses.
- [Daily registered domains](https://www.deepinfo.com/data-api/feeds/daily-registered-domain-names/) (Data feeds): Domains registered in the last day, as a file.

### Questions About IOC Feeds

**How are IOC Feeds delivered?**

Delivery is scoped with your team to the tools you already run. Everything the feeds draw on is also available through the Deepinfo API, with the same `apikey` header.

**Are the indicators about my organization or general?**

Both. Lookalike domains are matched to your brand keywords, and a dark web search can be scoped to your domains. Newly registered domains and the CVEs actors use are general, and your team chooses which of them to consume.

**Can we get the domain data without the platform?**

Yes. Newly registered domains and the other bulk files are also available on their own as [Deepinfo Data Feeds](https://www.deepinfo.com/data-api/feeds/).

### Wire Deepinfo Indicators Into Your Detection Stack.

Tell us which controls you run and we’ll scope the indicators that fit them, or book a walk-through of the data they come from.

[Talk to us about feeds](https://www.deepinfo.com/contact/) [Request demo](https://www.deepinfo.com/request-demo/)