IOC shelf-life calculator

Indicators of compromise go stale fast: IP addresses get reassigned, domains get parked and URLs get taken down. The shelf-life calculator estimates how much life an indicator has left based on its type, age and source.

Paste lists for bulk analysis to prune dead indicators from blocklists and reduce false positives.

As a rule of thumb, IP addresses are the shortest-lived indicators (often days to a few weeks), domains and URLs last somewhat longer, and file hashes stay valid the longest because a given malware sample never changes — though attackers recompile often.