ThreatFox IOC Database

You are browsing the Indicator Of Compromise (IOC) database of ThreatFox. If you would like to contribute IOCs to the corpuse, you can do so through either the web form or the API.

1'519

IOCs shared (past 24 hours)

AMOS

Most seen malware family (past 24 hours)

1'860'897

IOCs in corpus

Using the form below, you can search for malware samples by a hash (MD5, SHA256, SHA1), imphash, tlsh hash, ClamAV signature, tag or malware family.

Browse Database

Search syntax is as follow: keyword:search_term

Following is a list of accepted keywords along with an example search_term

ioc:ms-debug-services.com ( run)
malware:CobaltStrike ( run)
tag:TA505 ( run)
threat_type:cc_skimming ( run)
uuid:87f310f3-540b-11eb-922c-42010aa4000a ( run)

Date (UTC)	IOC	Malware	Tags	Reporter
2026-10-26 06:36	http://94.154.43.195/wget.sh	Unknown malware		xfoxg
2026-09-18 18:27	http://85.11.167.202/wget.sh	Unknown malware	honeypot	greedybear
2026-08-20 14:32	http://2.26.136.128/twget.sh	Unknown malware	Dropper	moldy
2026-08-20 14:32	http://45.150.195.235/twget.sh	Unknown malware	Dropper	moldy
2026-08-20 13:14	http://91.92.47.97/bins/wget.sh	Mirai	elf IoT	HoneyLabs
2026-06-27 06:24	http://bins.oceanic-node.su/wget.sh	Mirai	IoT Mirai telnet	Speculus
2026-01-17 16:20	http://45.92.29.74/wget.sh	Unknown malware	honeypot	greedybear
2025-09-08 13:44	http://150.40.118.15/wget.sh	Unknown malware	honeypot	greedybear
2025-09-01 05:55	http://103.153.69.151/wget.sh	Unknown malware	honeypot	BobDobalina
2025-08-19 04:18	http://196.251.80.130:4565/wget.sh	Unknown malware	honeypot	greedybear
2025-08-03 06:51	http://207.244.199.222/wget.sh	Unknown malware	honeypot	greedybear
2024-09-15 18:47	http://185.142.53.6/wget.sh	Mirai		Anonymous
2024-06-19 06:59	http://154.204.178.164/wget.sh	Mirai	Gafgyt Mirai	lontze7
2022-04-16 16:04	http://45.95.55.24/wget.sh	Mirai	Mirai	sutehk_cs