An Indicator of Compromise (IOC) is a piece of observable information — an IP address, a domain name, a URL, a file hash, or an email address — that has been associated with malicious activity. IOC checking is the process of looking up whether the indicators you observe in your environment appear on known threat lists. It is one of the most practical forms of threat intelligence available to a small business without a dedicated security team.
What each IOC type can tell you
IP addresses appear in server access logs, email headers, and firewall logs. An IP address that sent a high volume of requests to your website, appeared as the source of a failed login attempt, or was listed in an email's Received headers can be checked against threat intelligence databases. AbuseIPDB aggregates reports of IP addresses used for spam, scanning, and attacks. VirusTotal checks an IP against multiple vendor databases. A high abuse score or multiple vendor detections suggests the IP is associated with malicious infrastructure — not proof that an attack succeeded, but useful context.
Domain names appear in phishing emails (as the sender domain or as linked destinations), in malware reports, and in website redirect chains. Checking a suspicious domain against VirusTotal, URLVoid, or Google's Safe Browsing API shows whether it has been flagged by security vendors as malicious, phishing, or spam-related. The age of a domain (newly registered domains are frequently used in phishing campaigns) and its hosting history can also be informative.
File hashes (MD5, SHA1, SHA256) are fingerprints of files. If you discover an unexpected file on your server or a suspicious attachment, you can calculate its hash and check it against VirusTotal without uploading the file itself. VirusTotal's hash lookup tells you whether the identical file has previously been identified as malicious by any of its vendor partners — useful for confirming whether a suspicious PHP file found on a server is known malware.
Why context matters
A positive IOC check — an IP that appears on a threat list — does not automatically mean your business has been attacked. Many IP addresses flagged in threat databases are residential addresses that were previously used by malware and have since been reassigned. A domain that appears as low-risk one day may be reclassified the next as new reports come in. Context matters: How many vendors flagged it? How recently? In what category? Is it the same type of activity as what you are investigating?
Treat IOC checks as evidence that informs investigation rather than verdicts that conclude it. A single IOC finding should prompt more investigation, not immediate action. Multiple corroborating findings — an IP that appears in your access logs, that is associated with known malware infrastructure, that also appears in email headers of a suspicious message — collectively build a stronger case for response.
How to record findings for review
When conducting IOC checks during an incident, keep a running record of what you checked, what the result was, and where you found it. This log becomes part of your incident timeline and is useful if you later involve a security professional, your hosting provider, or — in the case of a notifiable breach — a regulatory body. Include: the IOC value, the tool used, the result (score, detection count, verdict), and the date of the check.
- VirusTotal (virustotal.com) — check IPs, domains, URLs, and file hashes against 70+ vendors.
- AbuseIPDB (abuseipdb.com) — IP address abuse reports and confidence scores.
- URLVoid (urlvoid.com) — domain reputation and blacklist check.
- MXToolbox Blacklist Check (mxtoolbox.com/blacklists.aspx) — check your domain or IP against email blacklists.
- Google Safe Browsing (transparencyreport.google.com) — check URL and domain status.
- Record every check in a dated log: IOC, tool, result, and source of the finding.
Indicators of compromise help teams connect alerts, emails, files, and logs.
Open the cyber protection tools