ThreatFox IOC Database

You are browsing the Indicator Of Compromise (IOC) database of ThreatFox. If you would like to contribute IOCs to the corpuse, you can do so through either the web form or the API.

2'254

IOCs shared (past 24 hours)

Vidar

Most seen malware family (past 24 hours)

1'820'531

IOCs in corpus

Using the form below, you can search for malware samples by a hash (MD5, SHA256, SHA1), imphash, tlsh hash, ClamAV signature, tag or malware family.

Browse Database

Search syntax is as follow: keyword:search_term

Following is a list of accepted keywords along with an example search_term

ioc:ms-debug-services.com ( run)
malware:CobaltStrike ( run)
tag:TA505 ( run)
threat_type:cc_skimming ( run)
uuid:87f310f3-540b-11eb-922c-42010aa4000a ( run)

Date (UTC)	IOC	Malware	Tags	Reporter
2026-02-25 23:40	http://waterpressureelement.cc:8080/updater?for=2D8A3D3940EF3E86BDBC9C00AD78ED2A	Unknown malware	GoProxy	abuse_ch
2026-02-21 20:05	http://waterpressureelement.cc:8080/updater?for=5120D3FEDD36EAC912DB54C863CE59BB	Unknown malware	GoProxy	abuse_ch
2026-02-21 20:05	http://waterpressureelement.cc:8080/updater?for=85A8192051669E4383E3D2041F07FDC6	Unknown malware	GoProxy	abuse_ch
2026-02-20 18:05	http://waterpressureelement.cc:8080/updater?for=0AA6B9F07A5B27B2069C137C69EC91EB	Unknown malware	GoProxy	abuse_ch