ThreatFox IOC Database

You are browsing the Indicator Of Compromise (IOC) database of ThreatFox. If you would like to contribute IOCs to the corpuse, you can do so through either the web form or the API.


273

IOCs shared (past 24 hours)

ClearFake

Most seen malware family (past 24 hours)

1'729'576

IOCs in corpus


Using the form below, you can search for malware samples by a hash (MD5, SHA256, SHA1), imphash, tlsh hash, ClamAV signature, tag or malware family.

Browse Database


Search syntax is as follow: keyword:search_term

Following is a list of accepted keywords along with an example search_term

  • ioc:ms-debug-services.com ( run)
  • malware:CobaltStrike ( run)
  • tag:TA505 ( run)
  • threat_type:cc_skimming ( run)
  • uuid:87f310f3-540b-11eb-922c-42010aa4000a ( run)

Date (UTC)IOCMalwareTagsReporter
2026-07-29 07:41104.244.78.15:36048 TsunamiDDoS MIPS router Elek02
2026-07-18 18:02156.67.218.115:8080 TsunamiTsunami abuse_ch
2026-07-18 18:02151.106.52.209:8080 TsunamiTsunami abuse_ch
2026-06-25 03:14144.31.151.138:5000 Tsunamic2 DDoS go ORBITAL nullblue67
2026-06-25 03:1462.238.37.207:6379 TsunamiDDoS redis nullblue67
2026-06-22 09:06188.245.99.156:10000 Tsunamic2 multi-c2 python-agent nullblue67
2026-06-21 06:4787.249.134.3:22 Tsunamiboyzee phoenix-c2 ssh nullblue67
2026-06-21 06:47194.238.26.34:8880 Tsunamiboyzee c2 phoenix nullblue67
2026-06-12 08:5343.133.157.218:6379 Tsunamimodule-load Muhstik rce redis nullblue67
2026-06-12 08:53ef9a91a7f3423d779353baebed34aa1f3b6104e7e4730c77fe8457b42a576ac5 TsunamiMuhstik rce redis-module nullblue67
2026-06-12 08:53e9c924c170332d42cae71bb9113ed9556cf91d5c50257b316eb433be9a211fb7 TsunamiMuhstik rce redis-module reverse-shell nullblue67
2026-06-12 08:53f32b209d33c4194f37dbbf2a677c4faf78cf6b24cf2474bf1c14aed17af40b2e TsunamiMuhstik rce redis-module reverse-shell nullblue67
2026-06-04 14:0694.140.120.193:8080 TsunamiTsunami abuse_ch
2026-06-04 14:05rc.de-zahlung.eu TsunamiTsunami abuse_ch
2026-06-04 14:05rnd.exposedbotnets.ru TsunamiTsunami abuse_ch
2026-06-04 14:05irc.shadow-mods.net TsunamiTsunami abuse_ch
2026-04-02 15:27fff1f89c0e5a57690011c03d8bdfd32591511a0bcfe6b089d16a5897d3de60c8 Tsunamibotnet DDoS DHT go GOVTI P2P Lenny_3BO
2026-04-02 15:27103.79.79.21:8899 Tsunamibotnet DDoS DHT go GOVTI P2P Lenny_3BO
2026-04-02 15:27c60ad26439ffce79808749b500c35f3a2e71bc3057156c7161964c3f13a24330 Tsunamibotnet DDoS DHT go GOVTI P2P Lenny_3BO
2026-01-23 21:22109.111.55.222:8080 TsunamiTsunami abuse_ch
2025-11-21 07:15mircd.hokkien.my.id TsunamiTsunami abuse_ch
2025-11-21 07:15mircd.xiao.my.id TsunamiTsunami abuse_ch
2025-05-20 17:33185.236.24.192:14567 TsunamiTsunami abuse_ch
2025-04-10 17:39141.98.10.122:2222 TsunamiTsunami abuse_ch
2025-03-09 07:23138.197.78.18:8080 TsunamiTsunami abuse_ch
2025-02-26 18:33193.143.1.118:6667 TsunamiKaiten Tsunami abuse_ch
2025-02-10 12:09191.98.172.42:8080 TsunamiTsunami abuse_ch
2025-02-08 17:195.231.70.214:1252 TsunamiTsunami abuse_ch
2024-03-13 11:03185.172.128.146:443 TsunamiTsunami abuse_ch
2024-03-13 11:02http://185.172.128.146:443/sys/index.php TsunamiTsunami abuse_ch
2024-02-24 19:25dw.c4kdeliver.top TsunamiTsunami abuse_ch
2024-02-24 19:19fbi.su1001-2.top TsunamiKaiten Tsunami abuse_ch
2024-02-24 19:10pwn.oracleservice.top Tsunami8220-Gang abuse_ch
2024-02-16 09:29130.185.249.90:6667 TsunamiTsunami abuse_ch
2024-02-15 07:3591.92.252.34:6667 TsunamiTsunami abuse_ch
2023-06-27 09:03sh.sys-stat.download TsunamiTsunami abuse_ch
2023-06-27 05:20199.247.30.230:8080 TsunamiTsunami abuse_ch
2023-06-20 09:29ircx.us.to TsunamiIRC Tsunami abuse_ch
2023-06-20 09:29ircxx.us.to TsunamiIRC Tsunami abuse_ch
2023-06-20 09:28123.30.212.77:53 TsunamiIRC Tsunami abuse_ch
2023-05-28 17:05213.171.212.254:9981 TsunamiIrcBot Kaiten Tsunami r3dbU7z
2023-05-03 14:20121.130.2.180:6667 TsunamiTsunami abuse_ch
2023-03-27 06:1020.151.71.228:6667 TsunamiTsunami abuse_ch
2023-03-26 06:54irc.byroe.org TsunamiTsunami abuse_ch
2023-03-26 06:5354.165.154.154:6667 TsunamiTsunami abuse_ch
2023-03-26 06:53103.161.185.156:6667 TsunamiTsunami abuse_ch
2023-03-26 06:53167.99.137.140:6667 TsunamiTsunami abuse_ch
2023-03-26 06:4596.49.241.146:6667 TsunamiTsunami abuse_ch
2022-09-13 14:3593.95.229.203:8080 TsunamiTsunami abuse_ch
2022-07-11 14:05185.102.170.250:6667 TsunamiTsunami abuse_ch
2022-04-30 16:26http://61.177.137.133/x/1sh Tsunamicowrie Muhstik Tsunami honeymoon_ioc
2022-04-30 16:26http://61.177.137.133/x/irq0 Tsunamicowrie Muhstik Tsunami honeymoon_ioc
2022-04-30 16:26http://61.177.137.133/x/irq1 Tsunamicowrie Muhstik Tsunami honeymoon_ioc
2022-04-30 16:26http://61.177.137.133/x/irq2 Tsunamicowrie Muhstik Tsunami honeymoon_ioc
2022-04-30 16:26http://61.177.137.133/x/tty4 Tsunamicowrie Muhstik Tsunami honeymoon_ioc
2022-04-30 16:26http://61.177.137.133/x/tty5 Tsunamicowrie Muhstik Tsunami honeymoon_ioc
2022-04-30 16:26http://61.177.137.133/x/tty6 Tsunamicowrie Muhstik Tsunami honeymoon_ioc
2022-04-30 16:26http://61.177.137.133/x/pty Tsunamicowrie Muhstik Tsunami honeymoon_ioc
2022-04-30 16:26http://61.177.137.133/x/tty0 Tsunamicowrie Muhstik Tsunami honeymoon_ioc
2022-04-30 16:26http://61.177.137.133/x/tty1 Tsunamicowrie Muhstik Tsunami honeymoon_ioc
2022-04-30 16:26http://61.177.137.133/x/tty2 Tsunamicowrie Muhstik Tsunami honeymoon_ioc
2022-04-30 16:26http://61.177.137.133/x/tty3 Tsunamicowrie Muhstik Tsunami honeymoon_ioc
2022-04-30 07:5151.255.171.23:80 TsunamiTsunami abuse_ch
2022-04-16 14:2045.95.55.24:6667 TsunamiTsunami abuse_ch
2022-03-24 19:01144.172.71.162:8080 TsunamiTsunami abuse_ch
2022-03-14 01:10http://160.16.58.163/wp-content/.b/pty5 Tsunami sicehicetf
2022-03-14 01:10http://160.16.58.163/wp-content/.b/pty3 Tsunami sicehicetf
2022-03-14 01:10http://160.16.58.163/wp-content/.b/pty4 Tsunami sicehicetf
2022-03-14 01:10http://160.16.58.163/wp-content/.b/pty10 Tsunami sicehicetf
2022-03-14 01:10http://160.16.58.163/wp-content/.b/pty6 Tsunami sicehicetf
2022-03-14 01:10http://160.16.58.163/wp-content/.b/pty7 Tsunami sicehicetf
2022-03-14 01:10http://160.16.58.163/wp-content/.b/pty2 Tsunami sicehicetf
2022-03-14 01:10http://160.16.58.163/wp-content/.b/pty1 Tsunami sicehicetf
2022-03-14 01:10http://106.246.224.219/russia.sh Tsunami sicehicetf
2022-03-04 14:4737.44.244.106:8080 Tsunamilog4j Tsunami abuse_ch
2022-03-04 07:24195.20.125.38:8080 TsunamiTsunami abuse_ch
2022-02-15 01:585.181.25.210:443 TsunamiTsunami abuse_ch
2022-01-28 21:09198.199.127.168:3336 TsunamiTsunami abuse_ch
2022-01-28 21:08blow.myddns.rocks TsunamiTsunami abuse_ch
2022-01-25 20:2523.95.226.157:666 TsunamiTsunami abuse_ch
2022-01-23 11:4751.161.64.197:6667 TsunamiTsunami abuse_ch
2022-01-21 10:30104.168.71.132:80 TsunamiTsunami abuse_ch
2022-01-18 13:405.181.80.119:6668 TsunamiTsunami r3dbU7z
2022-01-13 19:4745.9.148.44:6667 TsunamiMuhstik Tsunami abuse_ch
2022-01-05 17:1066.178.182.1:8080 TsunamiTsunami abuse_ch
2022-01-05 06:09195.70.197.29:8080 TsunamiMuhstik Tsunami abuse_ch
2022-01-04 17:00http://202.110.187.205/x/irq2 TsunamiMuhstik Tsunami honeymoon_ioc
2022-01-04 17:00http://202.110.187.205/x/pty TsunamiMuhstik Tsunami honeymoon_ioc
2022-01-04 17:00http://202.110.187.205/x/tty6 TsunamiMuhstik Tsunami honeymoon_ioc
2022-01-04 17:00http://202.110.187.205/x/irq0 TsunamiMuhstik Tsunami honeymoon_ioc
2022-01-04 17:00http://202.110.187.205/x/irq1 TsunamiMuhstik Tsunami honeymoon_ioc
2022-01-04 17:00http://202.110.187.205/x/tty3 TsunamiMuhstik Tsunami honeymoon_ioc
2022-01-04 17:00http://202.110.187.205/x/tty4 TsunamiMuhstik Tsunami honeymoon_ioc
2022-01-04 17:00http://202.110.187.205/x/tty5 TsunamiMuhstik Tsunami honeymoon_ioc
2022-01-04 17:00http://202.110.187.205/x/tty0 TsunamiMuhstik Tsunami honeymoon_ioc
2022-01-04 17:00http://202.110.187.205/x/tty1 TsunamiMuhstik Tsunami honeymoon_ioc
2022-01-04 17:00http://202.110.187.205/x/tty2 TsunamiMuhstik Tsunami honeymoon_ioc
2022-01-04 17:00http://202.110.187.205/x/2sh TsunamiMuhstik Tsunami honeymoon_ioc
2022-01-04 17:00http://202.110.187.205/x/3sh TsunamiMuhstik Tsunami honeymoon_ioc
2022-01-04 17:00http://202.110.187.205/x/1sh TsunamiMuhstik Tsunami honeymoon_ioc
2021-12-26 21:15http://40.76.9.118:80/wp-content/themes/twentysixteen/Exploit.class Tsunamilog4shell Muhstik Tsunami honeymoon_ioc
2021-12-23 19:13121.140.99.236:1389 TsunamiCVE-2021-44228 log4j Muhstik rogue-ldap Tsunami tolisec
2021-12-23 10:40156.67.220.165:8080 TsunamiCVE-2021-44228 log4j Muhstik Tsunami abuse_ch
2021-12-22 04:38192.46.216.224:1389 TsunamiCVE-2021-44228 elf4j log4j Muhstik rogue-ldap Tsunami tolisec
2021-12-21 12:47185.246.87.50:1389 TsunamiCVE-2021-44228 log4j log4shell rogue-ldap Tsunami fish_illuminati
2021-12-20 10:21185.246.87.50:1389 TsunamiCVE-2021-44228 log4j Muhstik rogue-ldap abuse_ch
2021-12-20 09:06144.172.71.180:8080 TsunamiCVE-2021-44228 log4j Muhstik Tsunami abuse_ch
2021-12-19 08:305999a48c88183c43b370fea589d731ef16a3d2083b4808f847a8f5a6932e2734 Tsunami Virus_Deck
2021-12-19 08:308f7604a84c23d54738ca7958ebf33539a8ece60bef8cf0b480316950fa9d0b53 Tsunami Virus_Deck
2021-12-19 08:308b57e4cb07dd5d9c687b4f92c10792cc0b122b30ae3aaa3e61d1c68872c84493 Tsunami Virus_Deck
2021-12-19 08:30e20806791aeae93ec120e728f892a8850f624ce2052205ddb3f104bbbfae7f80 Tsunami Virus_Deck
2021-12-19 07:595.101.118.127:1389 TsunamiCVE-2021-44228 log4j Muhstik rogue-ldap Tsunami abuse_ch
2021-12-19 07:52i.l33t-ppl.info TsunamiCVE-2021-44228 log4j Muhstik Tsunami abuse_ch
2021-12-19 07:52i.shadow-mods.net TsunamiCVE-2021-44228 log4j Muhstik Tsunami abuse_ch
2021-12-19 07:32185.61.149.22:8080 TsunamiCVE-2021-44228 log4j Muhstik Tsunami abuse_ch
2021-12-17 15:48153.92.4.31:8080 TsunamiTusnami abuse_ch
2021-12-16 15:0631.131.16.127:1389 TsunamiCVE-2021-44228 log4j Muhstik rogue-ldap baem
2021-12-13 13:03194.163.133.36:1389 TsunamiCVE-2021-44228 log4j Muhstik r3dbU7z
2021-12-13 13:0079.172.214.11:1389 TsunamiCVE-2021-44228 log4j Muhstik r3dbU7z
2021-12-12 07:12194.59.165.21:8080 Tsunamilog4j Muhstik Tsunami abuse_ch
2021-12-12 07:1037.44.244.124:8080 TsunamiMuhstik abuse_ch
2021-12-11 19:302fe0e87ead108c8bcfd6f93d401da02ea7d0cbb0b50a1bb2deef6cafdefb4d0c Tsunami Virus_Deck
2021-12-11 19:30d9337c1ea42eb7b3f7bdedd303208f4f92166579e43fa32ddc561200db21db05 Tsunami Virus_Deck
2021-12-11 19:30eddcd0d13b461e60a52060fc8b60ddb06c552ff645ee557c40b43052ee35b029 Tsunami Virus_Deck
2021-12-11 19:3030417d794798e43e3cfeb559c00c758b9c9ae4195e2ba6d16848bdedcd4b1ffd Tsunami Virus_Deck
2021-12-11 19:1511d40b22c8938406ddb6bf0700c679e11eae0c4fde9f174efe19d8fdad82c511 Tsunami Virus_Deck
2021-12-11 19:1515e7942ebf88a51346d3a5975bb1c2d87996799e6255db9e92aed798d279b36b Tsunami Virus_Deck
2021-12-11 19:155fb63deb96eb24a181a58401882d064fc112036aab52a1126fbf254e07562595 Tsunami Virus_Deck
2021-12-11 19:1535387c36844de6ba749de73d74a813cd35dbbfce1538ce48ff6c33c7beb3ed65 Tsunami Virus_Deck
2021-12-11 19:15703e4b340c9bdbf716f9d866628f56077166eb0fcd607c5d0c2cd9a00cdb4ad8 Tsunami Virus_Deck
2021-12-11 19:15918099551b244ba8b3db2301fe69278f674c0745facf6bc6df6a613e34877344 Tsunami Virus_Deck
2021-12-11 19:1557cbf5ac72a698c258239b5b5b565f47da3be7609e1e922d0cf9931f21a286ee Tsunami Virus_Deck
2021-12-11 19:151ded1b751043430e98162d33554c15a900dfc529dfb1635aaaca56efba0a4b45 Tsunami Virus_Deck
2021-09-23 07:2545.9.148.182:8080 TsunamiTsunami abuse_ch
2021-08-16 07:21142.44.163.110:6667 TsunamiTsunami abuse_ch