Check indicators (IoC lookup)

    Check IP addresses, domains, URLs and file hashes against our consolidated IoC database. It is fed by abuse.ch (URLhaus, MalwareBazaar, Feodo Tracker), AlienVault OTX, CISA and curated industry feeds.

    Indicators total

    899,408

    Indicators total

    Across all sources, deduplicated.

    74,773

    New in 24 h

    Shows how current the data is.

    12

    Active feeds

    abuse.ch, AlienVault OTX and our own sources.

    Quick lookup

    Enter an IP, domain, URL or file hash; we return the score and when it was last seen. Signed-in users see the full provenance.

    Most recently observed indicators

    redacted preview

    Most recently observed indicators with type, score, origin and sources
    IndicatorTypeScoreCountryNetwork (ASN)Malware / tagsATT&CKSourcesLast seen
    326ea0e9…7b9fSHA-25695––boatnet–abuse.ch MalwareBazaar, abuse.ch ThreatFox
    136a6f05…2cf0SHA-25695––boatnet–abuse.ch MalwareBazaar, abuse.ch ThreatFox
    d1175383…8f26SHA-25695––boatnet–abuse.ch MalwareBazaar, abuse.ch ThreatFox
    48d5b33e…0361SHA-25695––boatnet–abuse.ch MalwareBazaar, abuse.ch ThreatFox
    473c2b00…9b04SHA-25695––boatnet–abuse.ch MalwareBazaar, abuse.ch ThreatFox
    d8fa0963…0769SHA-25695––boatnet–abuse.ch MalwareBazaar, abuse.ch ThreatFox
    92ab96d1…b18dSHA-25695––boatnet–abuse.ch MalwareBazaar, abuse.ch ThreatFox
    b5a5e518…0268SHA-25695––boatnet–abuse.ch MalwareBazaar, abuse.ch ThreatFox
    685d91b7…bc85SHA-25695––Mirai–abuse.ch MalwareBazaar, abuse.ch ThreatFox
    08fa6c7d…a238SHA-25692––Boatnet–abuse.ch ThreatFox
    cca941ce…1d87SHA-25692––Boatnet–abuse.ch ThreatFox
    915e87e4…c22fSHA-25695––Boatnet–abuse.ch MalwareBazaar, abuse.ch ThreatFox
    d0ccc66c…1550SHA-25695––Mirai–abuse.ch MalwareBazaar, abuse.ch ThreatFox
    fa3d0713…0ceaSHA-25695––Mirai–abuse.ch MalwareBazaar, abuse.ch ThreatFox
    62166f53…50b6SHA-25695––Mirai–abuse.ch MalwareBazaar, abuse.ch ThreatFox
    31541897…859dSHA-25695––Mirai–abuse.ch MalwareBazaar, abuse.ch ThreatFox
    54b687c2…3774SHA-25692––DHT–abuse.ch ThreatFox
    82de137c…2e44SHA-25695––unknown–abuse.ch MalwareBazaar, abuse.ch ThreatFox
    063ee3de…6d96SHA-25692––DHT–abuse.ch ThreatFox
    f86911bd…a874SHA-25695––DHT–abuse.ch MalwareBazaar, abuse.ch ThreatFox
    c2113922…564aSHA-25692––DHT–abuse.ch ThreatFox
    202f7046…380aSHA-25692––DHT–abuse.ch ThreatFox
    06357772…f2bcSHA-25692––DHT–abuse.ch ThreatFox
    09564df8…8b7aSHA-25695––unknown–abuse.ch MalwareBazaar, abuse.ch ThreatFox
    06bbe6f0…e8ffSHA-25692––DHT–abuse.ch ThreatFox
    18bf16d7…ac3dSHA-25692––DHT–abuse.ch ThreatFox
    dcff2981…0baaSHA-25692––DHT–abuse.ch ThreatFox
    ba447ecc…b380SHA-25692––DHT–abuse.ch ThreatFox
    d1bf06c4…e4daSHA-25695––unknown–abuse.ch MalwareBazaar, abuse.ch ThreatFox
    cd6e1c50…5a76SHA-25695––unknown–abuse.ch MalwareBazaar, abuse.ch ThreatFox
    b4951d87…290fSHA-25695––Mirai–abuse.ch MalwareBazaar, abuse.ch ThreatFox
    ad47c65a…0bdcSHA-25695––unknown–abuse.ch MalwareBazaar, abuse.ch ThreatFox
    a9c218c7…60d5SHA-25695––unknown–abuse.ch MalwareBazaar, abuse.ch ThreatFox
    95bc38b8…7bc8SHA-25695––unknown–abuse.ch MalwareBazaar, abuse.ch ThreatFox
    5196e9ed…d8ddSHA-25695––unknown–abuse.ch MalwareBazaar, abuse.ch ThreatFox
    314f667e…1250SHA-25695––unknown–abuse.ch MalwareBazaar, abuse.ch ThreatFox
    0a592e8c…56c3SHA-25695––unknown–abuse.ch MalwareBazaar, abuse.ch ThreatFox
    e36014f7…2f03SHA-25695––unknown–abuse.ch MalwareBazaar, abuse.ch ThreatFox
    86d73abb…47b3SHA-25695––unknown–abuse.ch MalwareBazaar, abuse.ch ThreatFox
    0defa131…4671SHA-25695––unknown–abuse.ch MalwareBazaar, abuse.ch ThreatFox
    ae548362…6141SHA-25695––unknown–abuse.ch MalwareBazaar, abuse.ch ThreatFox
    4e558881…0161SHA-25692––Mirai–abuse.ch ThreatFox
    94452a79…e86dSHA-25692––Mirai–abuse.ch ThreatFox
    b9ed96ca…7980SHA-25692––nuyar–abuse.ch ThreatFox
    a2f82ae4…0e41SHA-25692––nova–abuse.ch ThreatFox
    162fa95a…6794SHA-25692––frame–abuse.ch ThreatFox
    4d96831d…1327SHA-25692––macOS–abuse.ch ThreatFox
    074e44c7…b79dSHA-25692––macOS–abuse.ch ThreatFox
    f9c78deb…3d1aSHA-25692––macOS–abuse.ch ThreatFox
    b8e54362…bb98SHA-25692––macOS–abuse.ch ThreatFox

    Note: IP and domain values are redacted in the public view for data protection reasons (1.2.x.x, *.example.com). Full values are available to customers via the API.