Tofsee
4New IOCs · 24h
36New IOCs · 7 days
82Indicators tracked
4Independent feeds
2026-10-12 02:02Last activity
New indicators per day
2026-09-29 to 2026-10-12, by first report.
- Hash26
- IP11
- JA345
- Malware36
- C246
Where its infrastructure is hosted
Latest indicators
Filter the live feed →| First seen | Type | Indicator | Role | Where |
|---|---|---|---|---|
| 2026-10-12 02:02 | SHA256 | 5841bab13adf388b4f7623e3b107281a554a4d21ee13616240bf6f2c24f5d065 | Malware sample | — |
| 2026-10-11 14:27 | SHA256 | 80d62a953a0415953b66d241eccc30120418d20b1740080b3351f55ae6030090 | Malware sample | — |
| 2026-10-11 14:27 | IP | 124.108.115[.]100 | Contacted by malware | — |
| 2026-10-11 13:36 | SHA256 | 5453e8d6633ad9281a5148e5a9cd67b99c0f1da9084fb006c0511ad7ede7ca3b | Malware sample | — |
| 2026-10-11 08:09 | SHA256 | 33ae3cdc14b1a9a867f8661f62300315ed1e22c0e8a39184644d956ac515eb06 | Malware sample | — |
| 2026-10-11 06:20 | SHA256 | 29c668f765ea2bcc00c9a7335a61dd73b72e41df8d1c4723a06adf3423387b0b | Malware sample | — |
| 2026-10-11 04:58 | SHA256 | 30f653b8657611adf5b7d9171004c724c3f133c73b86c0432588480bab9f073c | Malware sample | — |
| 2026-10-11 04:58 | IP | 103.248.137[.]133 | Contacted by malware | — |
| 2026-10-11 04:58 | IP | 111.121.193[.]242 | Contacted by malware | — |
| 2026-10-11 03:15 | SHA256 | 42cb0eae293fea0e752b40dab868e5e43bf54dc9dfe0b336d7712a6ac1ed50e3 | Malware sample | — |
| 2026-10-11 03:15 | SHA256 | 8343adae439a92678ffcfaacd614232b2ca6841ee52b13cdf10660c4b9fa457b | Malware sample | — |
| 2026-10-11 01:44 | IP | 43.231.4[.]7 | Contacted by malware | — |
| 2026-10-11 01:14 | SHA256 | 5378c79cb94e5f7d290b684d329c18666ebc07921e9b810acb80a3ecf28bbbfb | Malware sample | — |
| 2026-10-11 01:14 | IP | 184.168.221[.]104 | Contacted by malware | — |
| 2026-10-10 13:10 | SHA256 | 635f248c931dbfee89de7899e595a7c58e40d18c2168c86e775a81960554d428 | Malware sample | — |
| 2026-10-10 12:55 | IP | 95.216.195[.]92 | Contacted by malware | — |
| 2026-10-09 09:05 | SHA256 | 3a4f1c7e3a5c517ea20ac5599c1f7f75faa2d550424b9e316bc607711c629c50 | Malware sample | — |
| 2026-10-09 08:34 | SHA256 | 425bb9da02ade66bf41652fa651caf32769e3d0e97c77151316691edb277c29d | Malware sample | — |
| 2026-10-09 06:59 | SHA256 | 0a7783e87879e8607ae88713db2e0e69dd2130b1df2f6e4fcec05ef2014f0377 | Malware sample | — |
| 2026-10-09 06:59 | SHA256 | 9cd13d91dcb777ebeb847979b055cc934c92c4ed3a54d2876e3ec180321a7370 | Malware sample | — |
| 2026-10-09 04:37 | SHA256 | 224e2ad698f508904dffcaad535bb6848a03d57791ea9af5d77bd9b588f9b169 | Malware sample | — |
| 2026-10-08 03:45 | SHA256 | 2253234414d408bba6edba48001e5b31b8afcaeab906be28af12c22ede7b9d91 | Malware sample | — |
| 2026-10-07 13:57 | SHA256 | d6c92fc28e4354b87d5533a1c23313ced1e433a5e0da512f212a7b54531de48a | Malware sample | — |
| 2026-10-07 12:03 | SHA256 | f081811e73143aa78b349b83b817cf2535812fcf5d0b68bb28ba6df7893cc3d6 | Malware sample | — |
| 2026-10-07 10:48 | SHA256 | 9ac4632738fa07fdd6aeeb84695060b282e6040347906786c056c4110db517db | Malware sample | — |
| 2026-10-07 10:48 | IP | 51.161.153[.]249 | Contacted by malware | — |
| 2026-10-07 10:48 | IP | 51.68.139[.]89 | Contacted by malware | — |
| 2026-10-07 10:09 | SHA256 | 058d908fdda86f4ce9334a22d5109881d3d08c18cc26895e92ea6a47ede7ff0e | Malware sample | — |
| 2026-10-07 10:09 | IP | 185.156.72[.]72 | Contacted by malware | — |
| 2026-10-07 10:09 | IP | 80.66.75[.]39 | Contacted by malware | — |
| 2026-10-06 19:24 | MD5 | 7e3841913e2fd4e3ecf9d382dcd7becd | payload | — |
| 2026-10-06 19:24 | SHA256 | 29792faf57cf4db368909f5675077599094a4fba753261f43b419c49621a4db8 | payload | — |
| 2026-10-06 19:24 | SHA1 | 7466081bbe7d75d12a4f011e728be8aaf5a7fe7b | payload | — |
| 2026-10-06 17:33 | SHA256 | 4abae8699162821ba85ee5e93ad7ab9c0c82b8895a501763ec74267639ce6ce0 | Malware sample | — |
| 2026-10-06 17:33 | SHA256 | 777b649dd8bbc8117925f790f02f8dcd9351856ac31d1e20b9a94de912a7b64d | Malware sample | — |
| 2026-10-06 04:46 | SHA256 | 29792faf57cf4db368909f5675077599094a4fba753261f43b419c49621a4db8 | Malware sample | — |
| 2025-11-13 04:54 | IP | 62.60.226[.]183:483 | Botnet C2 | — |
| 2019-10-26 07:31 | JA3 | ffefafdb86336d057eda5fdf02b3d5ce | malware_tls_client | — |
| 2019-09-12 06:56 | JA3 | 32926ca3e59f0413d0b98725454594f5 | malware_tls_client | — |
| 2019-08-09 23:56 | JA3 | fc2299d5b2964cd242c5a2c8c531a5f0 | malware_tls_client | — |
| 2019-08-03 20:15 | JA3 | 25d74b7b4b779eb1efd4b31d26d651c6 | malware_tls_client | — |
| 2019-07-16 23:29 | JA3 | d81d654effb94714a4086734fa0adad9 | malware_tls_client | — |
| 2019-07-02 06:26 | JA3 | 70a04365be5bbd4653698bebeb43ce68 | malware_tls_client | — |
| 2019-03-24 00:12 | JA3 | c0220cd64849a629397a9cb68f78a0ea | malware_tls_client | — |
| 2019-01-30 02:48 | JA3 | 08a8a4e85b25ac42e1490bc85cfdb5ce | malware_tls_client | — |
| 2018-11-29 20:46 | JA3 | c2b4710c6888a5d47befe865c8e6fb19 | malware_tls_client | — |
| 2018-11-17 05:17 | JA3 | 34f14a69ad7009ca5863379218af17f3 | malware_tls_client | — |
| 2018-11-16 13:26 | JA3 | 8f6c918dcb585ebbea05e2cc94530e3d | malware_tls_client | — |
| 2018-11-16 13:26 | JA3 | d76ee64fb7273733cbe455ac81c292e6 | malware_tls_client | — |
| 2018-09-18 00:29 | JA3 | 52c7396a501e4fecbdfa99c5408334ac | malware_tls_client | — |
| 2018-06-24 10:50 | JA3 | 0cc1e84568e471aa1d62ad4158ade6b5 | malware_tls_client | — |
| 2018-06-07 16:51 | JA3 | 807fca46d9d0cf63adf4e5e80e414bbe | malware_tls_client | — |
| 2018-06-07 15:08 | JA3 | bffa4501966196d3d6e90cee1f88fc89 | malware_tls_client | — |
| 2018-05-13 01:59 | JA3 | 1aee0238942d453d679fc1e37a303387 | malware_tls_client | — |
| 2018-04-03 00:40 | JA3 | d18a4da84af59e1108862a39bae7c9d4 | malware_tls_client | — |
| 2018-03-27 13:40 | JA3 | f22bdd57e3a52de86cda40da2d84e83b | malware_tls_client | — |
| 2018-03-22 15:42 | JA3 | c5deb9465d47232dd48772f9c4d14679 | malware_tls_client | — |
| 2018-03-19 23:24 | JA3 | 911479ac8a0813ed1241b3686ccdade9 | malware_tls_client | — |
| 2018-03-19 23:02 | JA3 | 17fd49722f8d11f3d76dce84f8e099a7 | malware_tls_client | — |
| 2018-03-18 09:41 | JA3 | dff8a0aa1c904aaea76c5bf624e88333 | malware_tls_client | — |
| 2018-03-15 01:06 | JA3 | e3b2ab1f9a56f2fb4c9248f2f41631fa | malware_tls_client | — |
| 2018-03-13 06:23 | JA3 | 9f62c4f26b90d3d757bea609e82f2eaf | malware_tls_client | — |
| 2018-03-11 19:23 | JA3 | 1fe4c7a3544eb27afec2adfb3a3dbf60 | malware_tls_client | — |
| 2018-03-11 10:37 | JA3 | b90bdbe961a648f0427db21aaa6ccb59 | malware_tls_client | — |
| 2018-03-11 09:34 | JA3 | fd80fa9c6120cdeea8520510f3c644ac | malware_tls_client | — |
| 2018-03-11 08:25 | JA3 | 906004246f3ba5e755b043c057254a29 | malware_tls_client | — |
| 2018-02-03 05:19 | JA3 | da949afd9bd6df820730f8f171584a71 | malware_tls_client | — |
| 2018-01-31 20:04 | JA3 | 7c410ce832e848a3321432c9a82e972b | malware_tls_client | — |
| 2018-01-31 08:06 | JA3 | e7643725fcff971e3051fe0e47fc2c71 | malware_tls_client | — |
| 2018-01-02 08:16 | JA3 | a50a861119aceb0ccc74902e8fddb618 | malware_tls_client | — |
| 2017-11-22 12:42 | JA3 | 7dcce5b76c8b17472d024758970a406b | malware_tls_client | — |
| 2017-11-04 18:03 | JA3 | a61299f9b501adcf680b9275d79d4ac6 | malware_tls_client | — |
| 2017-08-12 19:56 | JA3 | 1d095e68489d3c535297cd8dffb06cb9 | malware_tls_client | — |
| 2017-08-08 21:32 | JA3 | 1543a7c46633acf71e8401baccbd0568 | malware_tls_client | — |
| 2017-07-24 18:17 | JA3 | 03e186a7f83285e93341de478334006e | malware_tls_client | — |
| 2017-07-23 09:39 | JA3 | d7150af4514b868defb854db0f62a441 | malware_tls_client | — |
| 2017-07-20 17:44 | JA3 | df5c30e670dba99f9270ed36060cf054 | malware_tls_client | — |
| 2017-07-19 18:53 | JA3 | 96eba628dcb2b47607192ba74a3b55ba | malware_tls_client | — |
| 2017-07-18 18:53 | JA3 | 590a232d04d56409fab72e752a8a2634 | malware_tls_client | — |
| 2017-07-16 21:20 | JA3 | 4d7a28d6f2263ed61de88ca66eb011e3 | malware_tls_client | — |
| 2017-07-16 02:39 | JA3 | 70722097d1fe1d78d8c2164640ab6df4 | malware_tls_client | — |
| 2017-07-15 19:43 | JA3 | 35c0a31c481927f022a3b530255ac080 | malware_tls_client | — |
Defanged for safety. URL query strings removed.