A network indicator is an observable detail in network activity that may help identify or investigate a cyber threat. Examples include a domain or IP address contacted by malware, an unusual connection pattern, or traffic linked to a known malicious service. Indicators are clues, not proof on their own: legitimate services can share infrastructure, and attackers may change or reuse network resources.
Defenders use network indicators to search logs, monitor connections, and create detection or blocking rules. During a suspected malware incident, a security team might check whether devices contacted a suspicious domain and use the result to guide further investigation. In reports about malicious apps, indicators can help connect an app to external infrastructure, but reliable conclusions require supporting evidence such as telemetry or malware samples.