Live IOC Feed
103,926 recently reported malicious indicators from the last 7 days. Values are defanged — don't visit them.
| Indicator | Type | Malware / threat | First seen | Source |
|---|---|---|---|---|
| crackedkrypton[.]xyz | domain | Unknown RAT | ThreatFox | |
| goldfish[.]ua | domain | ClearFake | ThreatFox | |
| gutmann[.]lol | domain | KongTuke | ThreatFox | |
| 71vu88ey[.]bossbeyagency[.]click | domain | ClearFake | ThreatFox | |
| bossbeyagency[.]click | domain | ClearFake | ThreatFox | |
| gosciniecbielik[.]pl | domain | ClearFake | ThreatFox | |
| gozomet[.]pl | domain | ClearFake | ThreatFox | |
| greenertidings[.]co[.]za | domain | ClearFake | ThreatFox | |
| greeninstitute[.]mk | domain | ClearFake | ThreatFox | |
| www[.]giacalonerappresentanze[.]com | domain | ClearFake | ThreatFox | |
| gicls[.]com | domain | ClearFake | ThreatFox | |
| giftgivingsimplified[.]com | domain | ClearFake | ThreatFox | |
| thelocticiansalon[.]com | domain | ClearFake | ThreatFox | |
| galpaodaluz[.]com[.]br | domain | ClearFake | ThreatFox | |
| geem-international[.]com | domain | ClearFake | ThreatFox | |
| ghanshyamgupta[.]com | domain | ClearFake | ThreatFox | |
| garagepartner[.]com | domain | ClearFake | ThreatFox | |
| garlin[.]biz | domain | ClearFake | ThreatFox | |
| gasoxygen[.]ir | domain | ClearFake | ThreatFox | |
| gazandmarty[.]com | domain | ClearFake | ThreatFox | |
| gerbangpraja[.]com | domain | ClearFake | ThreatFox | |
| gestionmedicaensalud[.]com | domain | ClearFake | ThreatFox | |
| gfarming[.]com | domain | ClearFake | ThreatFox | |
| gasthaus-auerhahn[.]eu | domain | ClearFake | ThreatFox | |
| www[.]fondazioneannalisegalligani[.]it | domain | ClearFake | ThreatFox | |
| www[.]foukalek[.]cz | domain | ClearFake | ThreatFox | |
| www[.]furnaridentistaroma[.]it | domain | ClearFake | ThreatFox | |
| giardinodellezagare[.]com | domain | ClearFake | ThreatFox | |
| www[.]freddysbarbershop[.]it | domain | ClearFake | ThreatFox | |
| www[.]freepowergreen[.]it | domain | ClearFake | ThreatFox | |
| gba[.]gov[.]mw | domain | ClearFake | ThreatFox | |
| georgeslab[.]com | domain | ClearFake | ThreatFox | |
| gasthaus-auerhahn-rollsbach[.]de | domain | ClearFake | ThreatFox | |
| www[.]fresh-air[.]it | domain | ClearFake | ThreatFox | |
| portal2[.]bloomloop[.]lol | domain | RevStealer | ThreatFox | |
| amaranth5104[.]workers[.]dev | domain | php.shin_webshell | ThreatFox | |
| ac5qz4t1[.]urgentblue[.]com | domain | ClearFake | ThreatFox | |
| gardenservicos[.]com[.]br | domain | ClearFake | ThreatFox | |
| k1[.]bb69[.]org | domain | Vidar | ThreatFox | |
| gedici[.]de | domain | ClearFake | ThreatFox | |
| nossaestante[.]com[.]br | domain | StrelaStealer | ThreatFox | |
| kbyue62054[.]workers[.]dev | domain | php.shin_webshell | ThreatFox | |
| yrayg0ro[.]sleavepiker[.]com | domain | ClearFake | ThreatFox | |
| smtp[.]briskgrab[.]cc | domain | Unknown malware | ThreatFox | |
| athedsl-140723[.]home[.]otenet[.]gr | domain | php.shin_webshell | ThreatFox | |
| 241[.]74[.]191[.]92[.]dynamic[.]jazztel[.]es | domain | php.shin_webshell | ThreatFox | |
| artkoruna[.]ru | domain | StrelaStealer | ThreatFox | |
| arrtofphotography[.]com | domain | StrelaStealer | ThreatFox | |
| szuag45572[.]workers[.]dev | domain | php.shin_webshell | ThreatFox | |
| msnbot-52-167-144-190[.]search[.]msn[.]com | domain | php.shin_webshell | ThreatFox | |
| fileagreement[.]xyz | domain | Unknown Loader | ThreatFox | |
| flv[.]aeoncash[.]org | domain | Vidar | ThreatFox | |
| ayuow0q7[.]bossbey71[.]click | domain | ClearFake | ThreatFox | |
| bossbey71[.]click | domain | ClearFake | ThreatFox | |
| greatwivesforme[.]wifenet[.]lol | domain | Unknown malware | ThreatFox | |
| namecheat[.]niggerservers[.]xyz | domain | Unknown malware | ThreatFox | |
| vmi3703999[.]contaboserver[.]net | domain | Grandoreiro | ThreatFox | |
| www[.]fruitdelice[.]it | domain | ClearFake | ThreatFox | |
| travertinekurgans[.]info | domain | SmartApeSG | ThreatFox | |
| mivibo[.]workers[.]dev | domain | php.shin_webshell | ThreatFox | |
| oi[.]bb69[.]org | domain | Vidar | ThreatFox | |
| www[.]ambiopharmconsultingltdbackup1[.]com | domain | Remcos | ThreatFox | |
| frankfurt-hochzeitslocation[.]de | domain | Unknown malware | ThreatFox | |
| xckhk0cbdt[.]workers[.]dev | domain | php.shin_webshell | ThreatFox | |
| t750k3kz[.]enfejar[.]casino | domain | ClearFake | ThreatFox | |
| abreuquimica[.]com[.]br | domain | StrelaStealer | ThreatFox | |
| www[.]gabrovo[.]info | domain | ClearFake | ThreatFox | |
| georgeslab[.]cz | domain | ClearFake | ThreatFox | |
| 3j7cilgavj[.]workers[.]dev | domain | php.shin_webshell | ThreatFox | |
| kfsesbn5[.]paars[.]poker | domain | ClearFake | ThreatFox | |
| surfixasa[.]duckdns[.]org | domain | XWorm | ThreatFox | |
| blbekcpc[.]bossbey69[.]click | domain | ClearFake | ThreatFox | |
| b8ecrz1g[.]yellohotelsharmoni[.]com | domain | ClearFake | ThreatFox | |
| bossbey69[.]click | domain | ClearFake | ThreatFox | |
| bloom-88[.]com | domain | AMOS | ThreatFox | |
| lvtraveladventures[.]com | domain | StrelaStealer | ThreatFox | |
| toqokify[.]workers[.]dev | domain | php.shin_webshell | ThreatFox | |
| ksm[.]aeoncash[.]org | domain | Vidar | ThreatFox | |
| garsonuoma[.]lt | domain | ClearFake | ThreatFox | |
| gestir[.]is | domain | ClearFake | ThreatFox | |
| nvprofessional[.]com | domain | StrelaStealer | ThreatFox | |
| www[.]friesen-bau[.]de | domain | ClearFake | ThreatFox | |
| qjtus57484[.]workers[.]dev | domain | php.shin_webshell | ThreatFox | |
| www[.]freedomsolar[.]hu | domain | ClearFake | ThreatFox | |
| ciganshina[.]org | domain | ClearFake | ThreatFox | |
| panel[.]servererr[.]beer | domain | ClearFake | ThreatFox | |
| worktoday[.]3utilities[.]com | domain | Remcos | ThreatFox | |
| 6rpbrwoxih[.]workers[.]dev | domain | php.shin_webshell | ThreatFox | |
| fbcx5nas[.]bossbey15[.]click | domain | ClearFake | ThreatFox | |
| mopsikimilie[.]cc | domain | MopsStealer | ThreatFox | |
| genovaorobotic[.]com | domain | MacSync | ThreatFox | |
| 7vpwppvd[.]bossbey31[.]click | domain | ClearFake | ThreatFox | |
| bossbey31[.]click | domain | ClearFake | ThreatFox | |
| wipyne[.]workers[.]dev | domain | php.shin_webshell | ThreatFox | |
| www[.]osamaphplogisticesbackup2[.]com | domain | Remcos | ThreatFox | |
| www[.]osamaphplogistices[.]com | domain | Remcos | ThreatFox | |
| www[.]osamaphplogisticesbackup[.]com | domain | Remcos | ThreatFox | |
| www[.]osamaphplogisticesbackup1[.]com | domain | Remcos | ThreatFox | |
| xk8yzcu5[.]bossbeycrown[.]click | domain | ClearFake | ThreatFox | |
| forwardtranslate[.]com[.]ar | domain | ClearFake | ThreatFox |