ThreatFox IOC Database

You are browsing the Indicator Of Compromise (IOC) database of ThreatFox. If you would like to contribute IOCs to the corpuse, you can do so through either the web form or the API.


543

IOCs shared (past 24 hours)

ClearFake

Most seen malware family (past 24 hours)

1'727'488

IOCs in corpus


Using the form below, you can search for malware samples by a hash (MD5, SHA256, SHA1), imphash, tlsh hash, ClamAV signature, tag or malware family.

Browse Database


Search syntax is as follow: keyword:search_term

Following is a list of accepted keywords along with an example search_term

  • ioc:ms-debug-services.com ( run)
  • malware:CobaltStrike ( run)
  • tag:TA505 ( run)
  • threat_type:cc_skimming ( run)
  • uuid:87f310f3-540b-11eb-922c-42010aa4000a ( run)

Date (UTC)IOCMalwareTagsReporter
2026-07-11 05:29bd894e0e215af7fa9a6c99cb939efd7183b5cbf845c9e0b5e6038a95bd58c11a Cpuminerchronic-nightmare credential-theft monero-miner ROOTKIT tor-c2 Worm MatthewBurford
2025-12-20 07:19http://45.131.184.34/bot Cpuminer 0xTea
2024-05-28 07:02backup.identitynetwork.top Cpuminerbotnetdomain coinminers Redtail abus3reports
2024-05-28 07:02backupnet.identitynetwork.top Cpuminerbotnetdomain coinminers Redtail abus3reports
2024-05-28 07:02srv.identitynetwork.top Cpuminerbotnetdomain coinminers Redtail abus3reports
2024-05-28 07:02tor-exit1.identitynetwork.top Cpuminerbotnetdomain coinminers Redtail abus3reports
2024-05-28 07:02identitynetwork.top Cpuminerbotnetdomain coinminers Redtail abus3reports
2024-05-28 07:02proxies.identitynetwork.top Cpuminerbotnetdomain coinminers Redtail abus3reports
2023-10-06 12:38http://185.225.75.242/download/xmrig.x86_64 Cpuminerminer CyberAn0maly
2022-07-16 16:3845.9.148.117:80 Cpuminer albooboo_ioc
2021-12-16 10:57http://135.125.217.87/jndi.sh Cpuminerlog4j EdGtslFcbngq6sk
2021-12-16 10:57http://165.227.239.108/stl.sh Cpuminerlog4j EdGtslFcbngq6sk
2021-12-16 10:57http://135.125.217.87/jndialive.sh Cpuminerlog4j EdGtslFcbngq6sk