Threat Intelligence Feed Correlation: Mapping Overlap Between Public Phishing Data Sources

Abstract

Cross-referencing vspam.org confirmed IOCs against PhishTank, OpenPhish, URLhaus, and APWG feeds to measure unique coverage and identify blind spots in the collective phishing intelligence ecosystem.

Key Findings

1. 1vspam.org contributed 18.3% unique IOCs not found in any other analyzed public feed
2. 2Combined coverage of all 5 feeds reached 89% of known active phishing URLs (sampled via honeypots)
3. 3Email-based phishing IOCs had the lowest cross-feed overlap (34%), indicating significant blind spots
4. 4Average lag between first appearance in any feed and propagation to all feeds: 6.8 hours
5. 5Domain-based IOCs showed highest correlation (72% overlap) across all analyzed feeds

Topics