Cross-source IOC correlation

Indicators that appear in 2+ independent IOC feeds. A single feed can carry false positives; consensus across independent sources is what analysts trust. Higher source-count = higher confidence the indicator is currently malicious.

Aggregated across 18 public IOC feeds: TweetFeed, SANS ISC, C2IntelFeeds, Emerging Threats, AlienVault OTX, BlocklistProject (ransomware + scam), the abuse.ch suite, Ipsum, CINS, and more.