What is an IOC (indicator of compromise)?

An indicator of compromise (IOC) is a technical fact you can search for on a host, in logs, or on the wire. Classic examples: a C2 IP, a phishing URL, a malware SHA-256, a domain used in a kit, an email used as a drop account, a CVE that is being exploited in the wild.

IOCs are brittle. Attackers rotate infrastructure. That is why enrichment and expiry matter: a Feodo Tracker botnet IP from this week is more useful than a five-year-old paste. Makondoo’s dashboard is the current Threatr page of ingested observables, not a forever museum.

IOC types on this platform

IPv4 / IPv6 — botnet C2, scanners, SSL blacklist hits.
Domain / hostname / URL — phishing and malware distribution (OpenPhish, URLhaus).
MD5 / SHA1 / SHA256 — malware samples; hashes can also be checked against CIRCL hashlookup on investigate.
Email — Threatr email observables, plus Hudson Rock infostealer OSINT (not Have I Been Pwned’s paid email corpus).
CVE — vulnerability identifiers when they appear as observables or in BOM/OSV findings.

How to use IOCs without drowning

Do not dump the entire public internet into a firewall. Pivot: investigate one indicator, follow related entities, match against your hostnames via the attack-surface BOM (certificate transparency). That is the difference between a feed subscriber and an analyst.

Programmatic access: GET https://api.threat-intel.makondoo.org/iocs and POST /lookup. See the API documentation.

What does threat intel do?

Threat intelligence turns raw signals — malicious IPs, phishing URLs, malware hashes, attacker infrastructure — into something a defender can act on. On Makondoo, that means a live IOC dashboard from Threatr, an investigate panel for a single observable, and an attack-surface BOM built from certificate-transparency logs.

What is threat intelligence in simple terms?

It is evidence about who is attacking, how they attack, and which indicators to block. Data without context is a blocklist. Intelligence is that data plus source, timing, and how it relates to your assets.

What are the five stages of the threat intelligence lifecycle?

Direction (what you need to know), collection (feeds and lookups), processing (normalize and dedupe), analysis (what it means for you), and dissemination (dashboard, API, BOM). Makondoo covers collection through dissemination for public CTI; direction stays with your security team.

What is a threat intel platform?

A threat intelligence platform (TIP) stores indicators, enriches them, and exposes them to analysts and tools. Makondoo is a Threatr-backed TIP: ingested open feeds, cached vendor enrichment, a public adapter API, and BOM/SBOM matching — not a SIEM and not an EDR.

What is Threat Intelligence?

Cyber threat intelligence (CTI) is analyzed information about adversaries and their infrastructure. Strategic CTI is for leaders. Operational CTI is about campaigns. Technical CTI is IOCs you can put in a firewall. This site publishes technical CTI from public feeds and Threatr.

Is Makondoo threat intelligence free?

The public dashboard, investigate lookups (without forcing vendor refresh), BOM scans, and adapter API are free to use, rate-limited at 100 requests per hour per IP. Team and Enterprise are contact-sales for private ingest and hosted Threatr.