ThreatFox IOC Database

You are browsing the Indicator Of Compromise (IOC) database of ThreatFox. If you would like to contribute IOCs to the corpuse, you can do so through either the web form or the API.

1'497

IOCs shared (past 24 hours)

ClearFake

Most seen malware family (past 24 hours)

1'864'783

IOCs in corpus

Using the form below, you can search for malware samples by a hash (MD5, SHA256, SHA1), imphash, tlsh hash, ClamAV signature, tag or malware family.

Browse Database

Search syntax is as follow: keyword:search_term

Following is a list of accepted keywords along with an example search_term

ioc:ms-debug-services.com ( run)
malware:CobaltStrike ( run)
tag:TA505 ( run)
threat_type:cc_skimming ( run)
uuid:87f310f3-540b-11eb-922c-42010aa4000a ( run)

Date (UTC)	IOC	Malware	Tags	Reporter
2025-11-03 10:04	571088182ed7e33d986b3aa2c51efd27	PolarEdge	PolarEdge	abuse_ch
2025-11-03 10:04	96b3be4cf3ad232ca456f343f468da0e	PolarEdge	PolarEdge	abuse_ch
2025-11-03 10:04	1fb2dfb09a31f0e8c63cc83283532f06	PolarEdge	PolarEdge	abuse_ch
2025-11-03 10:04	7fa5fb15098efdf76e4c016e2e17bb38	PolarEdge	PolarEdge	abuse_ch
2025-11-03 10:02	beastdositadvtofm.site	PolarEdge	PolarEdge	abuse_ch
2025-11-03 10:02	missionim.cc	PolarEdge	PolarEdge	abuse_ch