🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are browsing the Indicator Of Compromise (IOC) database of ThreatFox. If you would like to contribute IOCs to the corpuse, you can do so through either the web form or the API.


1'712

IOCs shared (past 24 hours)

Unknown Loader

Most seen malware family (past 24 hours)

1'868'845

IOCs in corpus


Using the form below, you can search for malware samples by a hash (MD5, SHA256, SHA1), imphash, tlsh hash, ClamAV signature, tag or malware family.

Browse Database


Search syntax is as follow: keyword:search_term

Following is a list of accepted keywords along with an example search_term

  • ioc:ms-debug-services.com ( run)
  • malware:CobaltStrike ( run)
  • tag:TA505 ( run)
  • threat_type:cc_skimming ( run)
  • uuid:87f310f3-540b-11eb-922c-42010aa4000a ( run)

Date (UTC)IOCMalwareTagsReporter
2026-11-09 07:5145.61.164.54:8085 OtterCookieCloudzy ContagiousInterview DPRK OtterCookie wristhulk
2026-11-09 07:5145.61.164.54:8086 OtterCookieCloudzy ContagiousInterview DPRK OtterCookie wristhulk
2026-11-09 07:5145.61.164.54:8087 OtterCookieCloudzy ContagiousInterview DPRK OtterCookie wristhulk
2026-11-03 05:29216.126.225.243:8086 OtterCookieContagiousInterview OtterCookie n4uu
2026-11-03 05:29216.126.225.243:8085 OtterCookieContagiousInterview OtterCookie n4uu
2026-10-28 19:07172.86.112.154:8085 OtterCookieContagiousInterview DPRK OtterCookie shmulc
2026-10-28 19:07172.86.112.154:8086 OtterCookieContagiousInterview DPRK OtterCookie shmulc
2026-10-28 19:07172.86.112.154:8087 OtterCookieContagiousInterview DPRK OtterCookie shmulc
2026-10-28 19:07https://www.hamilix.com/api/ipcheck-encrypted/604 OtterCookieContagiousInterview DPRK OtterCookie shmulc
2026-10-28 19:07https://ide-hooker-v1-eight.vercel.app/settings/bootstraplinux?flag=4 OtterCookieContagiousInterview DPRK OtterCookie shmulc
2026-10-28 19:07https://www.elixirfoundry.xyz/settings/mac?flag=4 OtterCookieContagiousInterview DPRK OtterCookie shmulc
2026-10-28 19:07https://ide-hooker-v1-eight.vercel.app/settings/env?flag=4 OtterCookieContagiousInterview DPRK OtterCookie shmulc
2026-10-28 19:07https://www.elixirfoundry.xyz/settings/linux?flag=4 OtterCookieContagiousInterview DPRK OtterCookie shmulc
2026-10-28 19:07https://www.configs.live/settings/linux?flag=8 OtterCookieContagiousInterview DPRK OtterCookie shmulc
2026-10-28 19:07www.ipregionchecker.org OtterCookieContagiousInterview DPRK OtterCookie shmulc
2026-10-28 19:07c1564dfcd2abad822c7b8998d1c1354602848fb258fde278c772c0a65ce849ef OtterCookieContagiousInterview DPRK OtterCookie shmulc
2026-09-30 19:00107.182.130.29:2250 OtterCookieContagiousInterview git-hook InvisibleFerret NodeJS XCTDH Anonymous
2026-09-21 16:245.231.107.180:3000 OtterCookiec2 contagious-interview NodeJS OtterCookie Isk0o
2026-09-21 16:24138.226.247.152:443 OtterCookiec2 contagious-interview NodeJS OtterCookie Isk0o
2026-09-18 05:05https://www.jsonkeeper.com/b/PAB1R OtterCookiec2 contagious-interview NodeJS OtterCookie Isk0o
2026-09-18 05:05https://www.jsonkeeper.com/b/7EBZP OtterCookiec2 contagious-interview NodeJS OtterCookie Isk0o
2026-09-18 05:05138.226.247.152:80 OtterCookiec2 contagious-interview NodeJS OtterCookie Isk0o
2026-09-18 05:05http://138.226.247.152:80/session/0f2a3fba69d29493 OtterCookiec2 contagious-interview NodeJS OtterCookie Isk0o
2026-04-23 07:52cloudflareinsights.vercel.app OtterCookie johannes
2026-04-23 07:52cloudflarefirewall.vercel.app OtterCookie johannes
2026-04-23 07:52cloudflaresecurity.vercel.app OtterCookie johannes