ThreatFox IOC Database

You are browsing the Indicator Of Compromise (IOC) database of ThreatFox. If you would like to contribute IOCs to the corpuse, you can do so through either the web form or the API.


579

IOCs shared (past 24 hours)

ClearFake

Most seen malware family (past 24 hours)

1'727'423

IOCs in corpus


Using the form below, you can search for malware samples by a hash (MD5, SHA256, SHA1), imphash, tlsh hash, ClamAV signature, tag or malware family.

Browse Database


Search syntax is as follow: keyword:search_term

Following is a list of accepted keywords along with an example search_term

  • ioc:ms-debug-services.com ( run)
  • malware:CobaltStrike ( run)
  • tag:TA505 ( run)
  • threat_type:cc_skimming ( run)
  • uuid:87f310f3-540b-11eb-922c-42010aa4000a ( run)

Date (UTC)IOCMalwareTagsReporter
2026-05-23 14:5487.121.79.73:80 Dofloochroot-escape docker Dofloo Dropper nullblue67
2026-05-23 14:5487.121.79.193:80 Dofloochroot-escape docker Dofloo Dropper nullblue67
2026-05-23 14:54http://151.242.125.187/dck Dofloodocker Dofloo escape nsenter nullblue67
2026-05-23 14:54http://87.121.79.73/dck Dofloodocker Dofloo escape nullblue67
2026-05-23 14:54http://87.121.79.193/dck Dofloodocker Dofloo escape nullblue67
2026-05-22 11:36151.242.125.187:80 Dofloocontainer-breakout docker-exploit Downloader nsenter-escape privileged-container nullblue67
2026-05-21 11:5514.46.136.77:443 Dofloodocker-exploit docker-worm Downloader nullblue67
2023-01-21 04:056135ccfdfb4442ef110d2ed297bc10872e0f3ee88a9b0c2d290a8bf10aba0a99 Dofloo parthmaniar
2023-01-21 04:05a4fc77b8608c2aea69db5f242e6519b6d8e6ea1b88731fa3bee9f5bf447031d0 Dofloo parthmaniar
2023-01-21 04:059361b3535eae16b1f9098cc41e12a16238fce3a2074e3711723bad09ee869931 Dofloo parthmaniar
2023-01-21 04:056224cb3e00c983759b3e011a1e397f8890fbd59be9bb9021c0c613f3617a782a Dofloo parthmaniar
2023-01-21 04:0530b23346414f8e0cb0b12440b09affd620638d2efcc1edec3938a31c4a206f77 Dofloo parthmaniar
2023-01-21 04:05fc75df49ece4e0235ab89ed52b193166a1dd90b9c4111c63a1cce06ed3844de5 Dofloo parthmaniar
2023-01-21 04:05ec75a54f68ebc269b5f8f5c29d20913dd4bef3f1db16cafc80361f52546f4e13 Dofloo parthmaniar
2023-01-21 04:059b4a2733f62d18589a6e46b95b501d19278160f727ca7d63f26d694a100c5ed1 Dofloo parthmaniar
2023-01-21 04:058d2ac59ce33d2d0527621e6b940426c3ff912572e89d813f34d958b0e9836175 Dofloo parthmaniar
2023-01-21 04:0560bd66a1030622684651bf43aeecbaf4eb375944187d2dd97c895213fbf03be9 Dofloo parthmaniar
2023-01-21 04:0518d1950e359f2735d9b3a881ed0db1a303a63ea29f5bfe3c512859ba111a85e8 Dofloo parthmaniar
2023-01-21 04:05e82dd1f4afdd3ab5298ddaee0051d5a7047417dfd65c6e53fcdad53b78f8b699 Dofloo parthmaniar
2023-01-21 04:05606e6fdd2dea51819d3719d6fc2fa604f420fe1d6c439c533464c003bbb32b06 Dofloo parthmaniar
2022-03-02 14:40209.141.59.94:48080 DoflooDofloo abuse_ch
2021-12-20 14:2449.0.248.230:2017 DoflooAESDDoS CVE-2021-44228 Dofloo log4j abuse_ch