🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are browsing the Indicator Of Compromise (IOC) database of ThreatFox. If you would like to contribute IOCs to the corpuse, you can do so through either the web form or the API.


1'555

IOCs shared (past 24 hours)

AsyncRAT

Most seen malware family (past 24 hours)

1'777'245

IOCs in corpus


Using the form below, you can search for malware samples by a hash (MD5, SHA256, SHA1), imphash, tlsh hash, ClamAV signature, tag or malware family.

Browse Database


Search syntax is as follow: keyword:search_term

Following is a list of accepted keywords along with an example search_term

  • ioc:ms-debug-services.com ( run)
  • malware:CobaltStrike ( run)
  • tag:TA505 ( run)
  • threat_type:cc_skimming ( run)
  • uuid:87f310f3-540b-11eb-922c-42010aa4000a ( run)

Date (UTC)IOCMalwareTagsReporter
2026-09-20 05:3245.32.65.138:443 xmrigcomfyui cryptojacking monero sparky xmrig adamivie
2026-09-19 18:02http://186.235.86.129/Photo.scr xmrigCoinMiner exe xmrig whack_sh
2026-09-19 05:5280.74.30.4:8765 xmrigbotnet comfyui cryptojacking monero sparky xmrig adamivie
2026-09-19 05:52193.181.209.137:8765 xmrigbotnet comfyui cryptojacking monero sparky xmrig adamivie
2026-09-19 05:52http://80.74.30.4:3000/sparky/comfyui-utils.git xmrigbotnet comfyui cryptojacking monero sparky xmrig adamivie
2026-09-19 05:52208.167.233.7:80 xmrigbotnet comfyui cryptojacking monero sparky xmrig adamivie
2026-09-19 05:52http://165.245.138.247:81/private/rigel-win.zip xmrigbotnet comfyui cryptojacking monero sparky xmrig adamivie
2026-09-19 05:52http://165.245.138.247:81/private/xmrig-win.zip xmrigbotnet comfyui cryptojacking monero sparky xmrig adamivie
2026-09-19 05:52http://217.76.63.67:81/private/xmrig-win.zip xmrigbotnet comfyui cryptojacking monero sparky xmrig adamivie
2026-09-19 05:52http://217.76.63.67:81/private/rigel-win.zip xmrigbotnet comfyui cryptojacking monero sparky xmrig adamivie
2026-09-19 05:52http://103.249.201.108:81/private/xmrig-win.zip xmrigbotnet comfyui cryptojacking monero sparky xmrig adamivie
2026-09-19 05:52http://103.249.201.108:81/private/rigel-win.zip xmrigbotnet comfyui cryptojacking monero sparky xmrig adamivie
2026-09-19 05:526fa80698d7268f6e88aa88c06fb27ee99e1bcee747c2e76911e6206a5b1aeeb3 xmrigbotnet comfyui cryptojacking monero sparky xmrig adamivie
2026-09-19 05:520a813de910c312b2a0206a75ccf6f0f329690ff7e706d2e0f954b540c68fe8f3 xmrigbotnet comfyui cryptojacking monero sparky xmrig adamivie
2026-09-19 05:52b9df548d6214aa93b685c981fd4c39185fd9ef55933f17da1a0d7fe9321107e1 xmrigbotnet comfyui cryptojacking monero sparky xmrig adamivie
2026-09-10 05:13https://tweakz-dream-launcher.lovable.app/__l5e/assets-v1/f9eec8e0-95ce-4178-b709-6136c6e6321b/V4MP-Tweakz-Launcher.exe xmrigexe Loader xmrig whack_sh
2026-09-09 14:36http://111.235.143.155:8080/Video.scr xmrigwhack.sh whack_sh
2026-09-08 15:05http://103.8.164.18/Video.scr xmrigwhack.sh whack_sh
2026-09-08 07:34http://187.247.242.34/av.scr xmrigwhack.sh whack_sh
2026-08-04 07:32http://94.26.106.195:5555 xmrigcryptojacking proxyjacking traffmonetizer xmrig nwicks
2026-08-04 07:32http://94.26.106.195:80 xmrigcryptojacking proxyjacking traffmonetizer xmrig nwicks
2026-08-04 07:32http://57.129.119.218:13333 xmrigcryptojacking proxyjacking traffmonetizer xmrig nwicks
2026-05-09 06:59ad7b8b26efc32208989b25ee5eb281333326e7cf6ef92360e4fc21af96f14e52 xmrigautoit-injector charmap-hollow cryptominer xmrig Lenny_3BO
2026-03-05 09:48139.144.167.21:443 xmrigc2 shodan xmrig juroots
2026-02-23 08:025.61.40.97:8000 xmrigAS28753 c2 censys LEASEWEB-DE-FRA-10 open-dir xmrig DonPasci
2026-01-06 08:31154.89.152.200:9001 xmrigABCCLOUDSDNBHD-AS-AP AS139923 c2 CoinMiner xmrig DonPasci
2026-01-04 04:03140.112.62.119:80 xmrigAS17716 c2 censys NTU-TW open-dir xmrig DonPasci
2025-11-16 00:02115.190.22.7:80 xmrigAS137718 c2 censys open-dir VOLCANO-ENGINE xmrig DonPasci
2025-09-24 20:0245.204.214.219:1230 xmrigAS62468 c2 censys HKCLOUDX open-dir xmrig DonPasci
2025-08-28 20:0145.204.197.103:8000 xmrigAS62468 c2 censys HKCLOUDX open-dir xmrig DonPasci
2025-08-12 16:0265.49.232.44:8080 xmrigAS25820 c2 censys IT7NET open-dir xmrig DonPasci
2025-07-09 00:01144.172.104.87:8000 xmrigAS14956 c2 censys open-dir ROUTERHOSTING xmrig DonPasci
2025-07-06 20:01107.172.86.208:1389 xmrigAS-COLOCROSSING AS36352 c2 censys open-dir xmrig DonPasci
2025-06-30 00:02196.251.86.71:8080 xmrigAS401120 c2 censys CHEAPY-HOST open-dir xmrig DonPasci
2025-06-07 12:01179.61.147.132:443 xmrigAS210538 c2 censys KEYUBU open-dir xmrig DonPasci
2025-05-09 15:16http://panel.diicotsec.ru:8080/x/api/endpoint.php xmrigc2 CoinMiner xmrig juroots
2025-05-09 15:05panel.diicotsec.ru xmrigc2 CoinMiner xmrig juroots
2025-05-09 15:05auto.zerodaypool.ru xmrigc2 CoinMiner xmrig juroots
2025-05-06 20:01196.251.70.216:443 xmrigAS401120 c2 censys CHEAPY-HOST open-dir xmrig DonPasci
2025-04-28 04:02hovno.tobim6.eu xmrigAS13335 c2 censys CLOUDFLARENET open-dir xmrig DonPasci
2025-04-24 12:02104.233.210.195:8000 xmrigAS54600 c2 censys open-dir PEG-SV xmrig DonPasci
2025-03-31 10:4847.109.69.229:8080 xmrigxmrig orlof_v
2025-03-27 06:07blackhats.thehomeserver.net xmrig Random90
2025-03-14 16:02213.192.33.143:9898 xmrigAS16019 c2 censys open-dir VODAFONE-CZ-AS xmrig DonPasci
2025-03-14 12:02hovno.yummypear.cz xmrigAS13335 c2 censys CLOUDFLARENET open-dir xmrig DonPasci
2025-03-03 17:3859.36.188.253:8700 xmrigc2 xmrig s0ld13r
2025-03-03 16:55as1.catchthatrabbit.com xmrigxmrig s0ld13r
2025-03-03 16:55xunhuimg.35g.cn xmrigc2 xmrig s0ld13r
2025-03-03 16:55168.75.85.109:8081 xmrigxmrig s0ld13r
2025-02-19 05:45pool.waggel.xyz xmrigc2 miner xmrig s0ld13r
2025-02-19 05:45195.201.139.229:443 xmrigc2 miner xmrig s0ld13r
2025-02-17 05:232f022104248d395a01f0134b406ac9bcf7e2059d791695110505052b9064ca9f xmrig d1v35h
2025-02-12 16:0189.221.225.7:8083 xmrigAS44477 c2 censys open-dir STARK-INDUSTRIES xmrig DonPasci
2025-01-18 09:29https://cscrm-hiring.com/cs-applicant-crm-installer.zip xmrig weekndr_sec
2025-01-13 08:5791.193.19.109:13333 xmrigsliver johannes
2025-01-09 06:1745.138.16.193:7575 xmrigc2 IRC xmrig juroots
2025-01-08 20:0345.138.16.193:80 xmrigAS210558 c2 censys open-dir SERVICES-1337-GMBH xmrig DonPasci
2025-01-03 12:19172.84.76.231:443 xmrigAS397283 c2 censys open-dir ROCKETNODE xmrig DonPasci
2025-01-03 12:19172.84.76.231:80 xmrigAS397283 c2 censys open-dir ROCKETNODE xmrig DonPasci
2024-09-22 19:01206.206.76.183:3454 xmrigCoinMiner xmrig NDA0E
2024-08-21 00:59b3fc214094fbc7d1542542fd86d23963 xmrig Grim
2024-08-21 00:5922289a61cd8a347a03da845d34820534b3e617781447a91c6a0fb3b1e6f6a184 xmrig Grim
2024-08-21 00:5950f97ed0a4719a75ef7bd31c38a829ec0d155e92 xmrig Grim
2024-05-13 14:16http://51.195.211.231/api/endpoint.php xmrigAS16276 c2 OVH DonPasci
2024-04-05 06:25d8173caccd607e1579b3649650bf4eb3ca1d5ddad7ced8b7b6ed66c7fecfbe11 xmrigxmrig cyberja
2024-03-19 07:12xmr.2miners.com xmrig Xev
2024-03-19 07:12162.19.139.184:12222 xmrig Xev
2024-02-29 08:1582.153.138.25:13338 xmrig switch41
2023-12-29 19:47http://45.95.147.236/download/redtail.arm8 xmrig Xev
2023-12-29 19:47http://45.95.147.236/download/redtail.arm7 xmrig Xev
2023-12-29 19:47pool.supportxmr.com xmrig Xev
2023-12-29 19:47pool-fr.supportxmr.com xmrig Xev
2023-12-29 19:0945.95.147.236:80 xmrig Xev
2023-12-29 19:06http://45.95.147.236/download/redtail.i686 xmrig Xev
2023-12-29 19:06dw.ohuyal.xyz xmrig Xev
2023-12-29 19:06http://45.95.147.236/download/redtail.x86_64 xmrig Xev
2023-12-29 19:06xmr.ohuyal.xyz xmrig Xev
2023-12-29 19:06cnc.ohuyal.xyz xmrig Xev
2023-12-16 17:47http://94.156.71.160/carsalepanel/api/endpoint.php xmrig Xev
2023-12-16 17:47http://94.156.71.160/updater.exe xmrig Xev
2023-11-17 14:55http://135.181.11.36/api/endpoint.php xmrig Xev
2023-07-08 06:45http://77.105.147.158:5001/upload/ xmrigPOST iam_py_test