Live IOC Feed

Newly reported indicators of compromise; 467,910 tracked.

Trending today

Picked up by the most independent feeds in the last 24 hours. See all trending →

IndicatorRoleFamily / threatFeeds today
IP 165.154.1[.]144AttackerAttacking host4
IP 43.167.198[.]92AttackerMalicious IP4
IP 45.9.2[.]178AttackerAttacking host3
IP 201.24.116[.]175AttackerAttacking host3
IP 207.175.138[.]62AttackerAttacking host3

24 indicators match · newest first · updated 2026-10-12 10:35 UTC

First seenTypeIndicatorCategoryFamilyReported byWhereNetworkCopy
10-12 09:40Domainvtr[.]6666k[.]orgC21 feed ——
10-12 09:40URLhxxps://vtr[.]6666k[.]org/C21 feed ——
10-12 08:46SHA2561ba9ad409c967bacc905f9846354f43f4082938f06ad81fb7d1b0a88a2a4ac0bMalware1 feed ——
10-12 08:36URLhxxps://xsl[.]6666k[.]orgC21 feed ——
10-12 08:25Domainxsl[.]6666k[.]orgC21 feed ——
10-12 08:25URLhxxps://xsl[.]6666k[.]org/C21 feed ——
10-12 08:10Domainfqa[.]6666k[.]orgC21 feed ——
10-12 08:10URLhxxps://fqa[.]6666k[.]org/C21 feed ——
10-12 07:55Domainmim[.]6666k[.]orgC21 feed ——
10-12 07:55URLhxxps://mim[.]6666k[.]org/C21 feed ——
10-12 07:55URLhxxps://mim[.]6666k[.]orgC21 feed ——
10-12 07:48URLhxxps://bru[.]6666k[.]orgC21 feed ——
10-12 07:41SHA25620b50792cf0acda820f3b2a05ea738d9608c64950f7d3d30191f6c0d5bb25606Malware1 feed ——
10-12 07:40Domainbru[.]6666k[.]orgC21 feed ——
10-12 07:40URLhxxps://bru[.]6666k[.]org/C21 feed ——
10-12 07:24URLhxxps://gki[.]6666k[.]orgC21 feed ——
10-12 07:20Domaingki[.]6666k[.]orgC21 feed ——
10-12 07:20URLhxxps://gki[.]6666k[.]org/C21 feed ——
10-12 07:08URLhxxps://bok[.]6666k[.]orgC21 feed ——
10-12 07:05Domainbok[.]6666k[.]orgC21 feed ——
10-12 07:05URLhxxps://bok[.]6666k[.]org/C21 feed ——
10-12 06:51URLhxxps://kik[.]6666k[.]orgC21 feed ——
10-12 06:50Domainkik[.]6666k[.]orgC21 feed ——
10-12 06:50URLhxxps://kik[.]6666k[.]org/C21 feed ——

Values are defanged (hxxp, [.]) so nothing here is a live link to malicious infrastructure. URL query strings are removed to protect victims. Copy copies the defanged form.