Malicious Domain Feed

Newly reported malicious domains; 273,780 tracked.

5,000 indicators match · newest first · updated 2026-10-12 08:46 UTC

First seenIndicatorCategoryFamilyReported byCopy
10-12 08:45aldolittzation[.]infoPhishing—1 feed
10-12 08:45allegrolokalnie[.]pl83232[.]topPhishing—1 feed
10-12 08:45ammemcliqu[.]storePhishing—1 feed
10-12 08:45artisankagu[.]shopPhishing—1 feed
10-12 08:45dovaent[.]sitePhishing—1 feed
10-12 08:45easyitwas[.]onlinePhishing—1 feed
10-12 08:45exponentsvisllionaries[.]infoPhishing—1 feed
10-12 08:45fexnuro[.]shopPhishing—1 feed
10-12 08:45finzy3-rerum91[.]sbsPhishing—1 feed
10-12 08:45furtasticfashions[.]comPhishing—1 feed
10-12 08:45gamingbulletin[.]sitePhishing—1 feed
10-12 08:45guatafac[.]orgPhishing—1 feed
10-12 08:45gymyoga[.]shopPhishing—1 feed
10-12 08:45ibkknet[.]sitePhishing—1 feed
10-12 08:45overfocllusing[.]infoPhishing—1 feed
10-12 08:45pftgorw[.]shopPhishing—1 feed
10-12 08:45podriessegro[.]topPhishing—1 feed
10-12 08:45trendways[.]shopPhishing—1 feed
10-12 08:45velvetporthole[.]onlinePhishing—1 feed
10-12 08:45waisseprofession[.]topPhishing—1 feed
10-12 08:45whaduserdi[.]proPhishing—1 feed
10-12 08:45zvokmuvret-denmark[.]sbsPhishing—1 feed
10-12 08:45zvokmuvret-norway[.]sbsPhishing—1 feed
10-12 08:45zvokmuvret-romania[.]sbsPhishing—1 feed
10-12 08:25xsl[.]6666k[.]orgC21 feed
10-12 08:25profacelisting[.]infoC21 feed
10-12 08:24hsk19cqn[.]kaarenorge[.]comMalware1 feed
10-12 08:18sobiqisi[.]workers[.]devMalware1 feed
10-12 08:15fifaclubchamps[.]comC21 feed
10-12 08:114foutlet[.]shopPhishing—1 feed
10-12 08:11apprecresc[.]storePhishing—1 feed
10-12 08:11faqirsmajorittng[.]infoPhishing—1 feed
10-12 08:11fascinating-empanada-14b05e[.]netlify[.]appPhishing—1 feed
10-12 08:11finzy6-consequuntur88[.]sbsPhishing—1 feed
10-12 08:11minivillaeu[.]comPhishing—1 feed
10-12 08:11www[.]krvmb[.]shopPhishing—1 feed
10-12 08:10fqa[.]6666k[.]orgC21 feed
10-12 08:09solidebi[.]workers[.]devMalware1 feed
10-12 08:09startrekfleetcommand[.]comMalware1 feed
10-12 08:00www[.]jbnowclassprojecttodaybackup1[.]comC21 feed
10-12 08:00www[.]jbnowclassprojecttodaybackup2[.]comC21 feed
10-12 08:00www[.]jbnowclassprojecttoday[.]comC21 feed
10-12 08:00www[.]jbnowclassprojecttodaybackup[.]comC21 feed
10-12 07:55mim[.]6666k[.]orgC21 feed
10-12 07:42proxy-us-east008-cip6[.]ahrefs[.]netMalware1 feed
10-12 07:40bru[.]6666k[.]orgC21 feed
10-12 07:354foutlets[.]shopPhishing—1 feed
10-12 07:35alebilet[.]pay-u607456[.]ccPhishing—1 feed
10-12 07:35allegro[.]pay-u607456[.]ccPhishing—1 feed
10-12 07:35allegrolokalnie[.]pay-u607456[.]ccPhishing—1 feed
10-12 07:35alveronhome[.]comPhishing—1 feed
10-12 07:35ambuscadwwes[.]infoPhishing—1 feed
10-12 07:35blik[.]iqwerk[.]topPhishing—1 feed
10-12 07:35disildised[.]storePhishing—1 feed
10-12 07:35dreamtcowhyyides[.]infoPhishing—1 feed
10-12 07:35dromqavi[.]shopPhishing—1 feed
10-12 07:35elinavonniel[.]comPhishing—1 feed
10-12 07:35finzy2-debitis13[.]sbsPhishing—1 feed
10-12 07:35furnimind[.]comPhishing—1 feed
10-12 07:35izklmva[.]shopPhishing—1 feed
10-12 07:35olx[.]pay-u607456[.]ccPhishing—1 feed
10-12 07:35pay-u607456[.]ccPhishing—1 feed
10-12 07:35pay-u60876523[.]ccPhishing—1 feed
10-12 07:35vinted[.]pay-u607456[.]ccPhishing—1 feed
10-12 07:35zabezpieczenia[.]sbsPhishing—1 feed
10-12 07:31internetlouisiana[.]comMalware1 feed
10-12 07:28944i66mcky[.]workers[.]devMalware1 feed
10-12 07:20gki[.]6666k[.]orgC21 feed
10-12 07:12owo[.]efunmilowoonline[.]topC2—1 feed
10-12 07:12efunmilowoonline[.]topC2—1 feed
10-12 07:05bok[.]6666k[.]orgC21 feed
10-12 07:01accounnt-otnetfllix[.]165-154-255-231[.]cpanel[.]sitePhishing—1 feed
10-12 07:01aiapp-pl-investpro[.]comPhishing—1 feed
10-12 07:01ailgfmm[.]shopPhishing—1 feed
10-12 07:01babyproofffs[.]infoPhishing—1 feed
10-12 07:01civetverde[.]storePhishing—1 feed
10-12 07:01finzy3-autem32[.]sbsPhishing—1 feed
10-12 07:01givzelo[.]shopPhishing—1 feed
10-12 07:01porfidismo[.]storePhishing—1 feed
10-12 07:01seniorscarecenters[.]onlinePhishing—1 feed
10-12 07:01servidorasoficial[.]orgPhishing—1 feed
10-12 07:01taatis[.]shopPhishing—1 feed
10-12 07:01trustedgameratings[.]sitePhishing—1 feed
10-12 06:58teknnovationbyobaid[.]teknnovation[.]comMalware1 feed
10-12 06:53iy5iikmqxercpdjk5swzib2m2f3sn6o3o7khivgul4f47nweflusqiqd[.]onionC2—1 feed
10-12 06:534vr5sxshsx6se4qixnrvbqyikqtknfjhe4ybitp2zhjjzazm4ohawbid[.]onionC2—1 feed
10-12 06:50kik[.]6666k[.]orgC21 feed
10-12 06:49data[.]vaceditions[.]comMalware1 feed
10-12 06:49my-adobe-plugins-update[.]topMalware1 feed
10-12 06:49acrob[.]my-adobe-plugins-update[.]topMalware1 feed
10-12 06:30berryfiber[.]netPhishing—1 feed
10-12 06:30careworkerjobs[.]com[.]auPhishing—1 feed
10-12 06:30dictamenestructuralzacatecas[.]topPhishing—1 feed
10-12 06:30finzy0-voluptas44[.]sbsPhishing—1 feed
10-12 06:30finzy1-quisquam92[.]sbsPhishing—1 feed
10-12 06:30finzy5-voluptas74[.]sbsPhishing—1 feed
10-12 06:30otlghhl[.]shopPhishing—1 feed
10-12 06:30rectifiaaable[.]infoPhishing—1 feed
10-12 06:30tristspher[.]storePhishing—1 feed
10-12 06:30vwvbgrdigital[.]onlinePhishing—1 feed

Values are defanged (hxxp, [.]) so nothing here is a live link to malicious infrastructure. URL query strings are removed to protect victims. Copy copies the defanged form.