Request demo

IOC Feeds

Indicators Your Detection Stack Can Act On.

An indicator of compromise is an observable, such as a domain, an IP address or an email address, that points to malicious activity. Much of what the Deepinfo Platform already structures is exactly that.

IOC Feeds bring those indicators, with context such as the CVEs active threat actors use, to the tools that act on them. Which indicators, and how your team receives them, is scoped with you.

Talk to us about feeds Request demo

Drawn from

  • Lookalike domainsPOST /brp/fraudulent-domains/search domain
  • Dark web recordsPOST /discovery/darkweb-search IPemail
  • Newly registered domainsGET /feeds/daily-registered-domains domain
  • Actor capabilitiesPOST /cti/threat-actors/search CVE
  • Known exploited CVEsPOST /discovery/vulnerability-search CVE

Indicator

  • domain Deny listsEnrichment
  • IP Log huntingEnrichment
  • email Log huntingEnrichment
  • CVE PatchingEnrichment

Control

  • Deny lists
  • Log hunting
  • Patching
  • Enrichment

Indicators From Data the Platform Already Holds.

Indicators feed blocking and hunting. Context tells an analyst how much weight an indicator deserves. All the sources below sit behind one API and one key.

Lookalike domains · IndicatorPOST /brp/fraudulent-domains/search · Domains matched to your brand keywords by Brand Risk Protection, each with its DNS, SSL, WHOIS and web data history
Dark web records · IndicatorPOST /discovery/darkweb-search · Email addresses, IP addresses, crypto addresses and websites extracted from dark web records, and the CVEs they mention
Newly registered domains · EnrichmentGET /feeds/daily-registered-domains · Domains registered in the last day, delivered as a daily file
Actor capabilities · ContextPOST /cti/threat-actors/search · The CVEs and tools listed on each threat actor profile
Known exploited CVEs · ContextPOST /discovery/vulnerability-search · CVEs in the CISA KEV catalog, with the date added and the required action

Paths are relative to https://api.deepinfo.com/v1. Which of these your plan includes depends on your modules.

Send Each Indicator to the Right Control.

Mail and web

Lookalike Domains

A domain built to look like yours belongs on the deny list of your mail gateway and web proxy while the takedown runs.

Hunting

Dark Web Indicators

An IP address or an email address pulled from a dark web record is a lead to search for in your logs.

Patching

Actor-Used CVEs

A CVE that active actors use, found on one of your assets, is a patch that should not wait for the next cycle.

Enrichment

New Registrations

When an unfamiliar domain turns up in your traffic, a registration from yesterday changes how an analyst reads it.

A bare IP address is a block rule. With its record, it’s a lead.

That address next to the dark web record it came from, or a lookalike domain next to its DNS and certificate history, is something an analyst can reason about.

Apart from the daily registration file, each source here is a searchable record rather than a bare list, so the person who acts on an indicator can check it first.

Pull Indicators With the Filters You Already Use.

Fraudulent domain search, like most platform searches, has an export twin that returns all matching records in one response, without paging.

The filter body is the one the search already uses, so a list your analysts built in the platform becomes a scheduled pull in a few lines of code.

Fraudulent Domain Export reference
Export lookalike domains 
curl -X POST \
  "https://api.deepinfo.com/v1/brp/fraudulent-domains/search:export" \
  -H "apikey: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d @filter.json

The Records Behind the Indicators.

BRP Fraudulent Domain Monitoring Lookalike domains matched to your brand, with evidence. Read CTI Threat Actor Intelligence The CVEs and tools each actor uses. Read Data feeds Daily registered domains Domains registered in the last day, as a file. Read

Questions About IOC Feeds

How are IOC Feeds delivered?

Delivery is scoped with your team to the tools you already run. Everything the feeds draw on is also available through the Deepinfo API, with the same apikey header.

Are the indicators about my organization or general?

Both. Lookalike domains are matched to your brand keywords, and a dark web search can be scoped to your domains. Newly registered domains and the CVEs actors use are general, and your team chooses which of them to consume.

Can we get the domain data without the platform?

Yes. Newly registered domains and the other bulk files are also available on their own as Deepinfo Data Feeds.

Wire Deepinfo Indicators Into Your Detection Stack.

Tell us which controls you run and we’ll scope the indicators that fit them, or book a walk-through of the data they come from.

Talk to us about feeds Request demo