🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are browsing the Indicator Of Compromise (IOC) database of ThreatFox. If you would like to contribute IOCs to the corpuse, you can do so through either the web form or the API.


1'979

IOCs shared (past 24 hours)

Unknown Loader

Most seen malware family (past 24 hours)

1'764'050

IOCs in corpus


Using the form below, you can search for malware samples by a hash (MD5, SHA256, SHA1), imphash, tlsh hash, ClamAV signature, tag or malware family.

Browse Database


Search syntax is as follow: keyword:search_term

Following is a list of accepted keywords along with an example search_term

  • ioc:ms-debug-services.com ( run)
  • malware:CobaltStrike ( run)
  • tag:TA505 ( run)
  • threat_type:cc_skimming ( run)
  • uuid:87f310f3-540b-11eb-922c-42010aa4000a ( run)

Date (UTC)IOCMalwareTagsReporter
2026-08-18 07:18keratin-me.com Unknown Loaderetherhiding varysz
2026-08-17 16:08autobank-me.com Unknown Loaderetherhiding varysz
2026-07-27 19:57tricircle-me.com ClearFakeClearFake ClickFix skocherhan
2026-07-09 15:33life-coach-me.com Unknown Stealeretherhiding Polygon victim varysz
2025-11-23 12:17https://caliberinternational-me.com/css/MsftTeamsMeetings/Meetings/Teams/CCIcaseworks/Windows/invite.php Unknown RAT juroots
2025-04-06 04:29proximus-me.com HavocAS29802 c2 censys HVC-AS dyingbreeds_
2025-01-19 06:54https://post-to-me.com/api Lumma StealerLummaStealer abuse_ch
2025-01-19 06:53post-to-me.com Lumma StealerLummaStealer abuse_ch
2023-05-03 16:31https://smartway-me.com/ei/nemoquae.php QakBotBB26 js QakBot qbot Quakbot TR zip Cryptolaemus1
2023-05-03 16:25https://boomerang-me.com/tnse/doloremqueomnis.php QakBotBB26 QakBot qbot Quakbot TR WSF zip Cryptolaemus1
2023-02-27 19:49https://smartway-me.com/ETIN.php QakBotBB17 IMG pw764 QakBot qbot Quakbot TR zip Cryptolaemus1
2022-11-02 02:18intergulf-me.com QakBotBB05 BV1 iso QakBot qbot Quakbot TR zip Cryptolaemus1
2022-11-02 01:55https://intergulf-me.com/to/ QakBotBB05 BV1 iso QakBot qbot Quakbot TR zip Cryptolaemus1
2022-10-27 00:33https://appslink-me.com/ueo/ QakBotBB04 iso PG1 QakBot qbot Quakbot TR zip Cryptolaemus1
2022-10-26 23:49appslink-me.com QakBotBB04 iso PG1 QakBot qbot Quakbot TR zip Cryptolaemus1
2022-05-02 20:56https://dwm-me.com/ucc/Rpt/KQO/67j/Qj6RwYK.zip QakBotobama181 QakBot qbot zip Cryptolaemus1
2022-05-02 20:56https://dwm-me.com/ucc/Q/7TqJRICtd.zip QakBotobama181 QakBot qbot zip Cryptolaemus1
2022-05-02 20:56https://dwm-me.com/ucc/hIg/rph/gq3/dyVh9on.zip QakBotobama181 QakBot qbot zip Cryptolaemus1
2022-05-02 20:56https://dwm-me.com/ucc/3lUdNFba6q.zip QakBotobama181 QakBot qbot zip Cryptolaemus1
2021-06-16 16:25http://medica-me.com/root.php Hancitordoc Hancitor html Cryptolaemus1
2021-03-24 16:00https://www.epsilon-me.com/post.php Zloadernut zloader ffforward