IP1 dispatches
158[.]220[.]87[.]79Live check · abuse.ch · CISA KEV · NVD
IOC and CVE lookup
Paste any indicator — an IP, domain, URL, file hash or CVE. For IP/domain/URL/hash you get abuse.ch ThreatFox reputation (with the malware family behind it); for a CVE, CISA KEV exploitation status, FIRST EPSS probability and NVD detail.
examples:
Indicator reputation (abuse.ch ThreatFox) or CVE triage (CISA KEV · FIRST EPSS · NVD). No key required.
Feed indicators
IP addresses · 1
Domains · 8
DM1 dispatches
crates[.]ioDM1 dispatches
usbank[.]comDM1 dispatches
hunt[.]ioDM1 dispatches
any[.]runDM1 dispatches
gca-emailauth[.]orgDM1 dispatches
wordpress[.]orgDM1 dispatches
helper-beeps[.]solidityDM1 dispatches
web3devtoolsx[.]solidityLive malicious infrastructure · abuse.ch
4,805
active indicators · updated ~0h agoActive threat infrastructure tracked worldwide right now — C2 servers, malicious domains and payload hashes. The lookup above runs against exactly this list.
Most active malware families
Cobalt Strike
1,286
PureRAT
540
Vidar
385
AsyncRAT
356
Unknown malware
314
AdaptixC2
242
php.shin_webshell
196
ClearFake
172
Threat types
Botnet C24354Payload231Payload delivery220
Latest C2 indicators
Defanged — not clickable. Paste into the lookup above to investigate.
47[.]95[.]207[.]79:443Cobalt Strike
121[.]37[.]255[.]60:443Cobalt Strike
139[.]198[.]183[.]44:443Cobalt Strike
23[.]224[.]152[.]139:443Cobalt Strike
111[.]230[.]196[.]200:443Cobalt Strike
fivepointschiro[.]comCobalt Strike
104[.]128[.]92[.]144:443Cobalt Strike
107[.]173[.]89[.]148:443Cobalt Strike
62[.]113[.]255[.]12:443Cobalt Strike
101[.]32[.]204[.]81:443Cobalt Strike
77[.]83[.]36[.]54:443Cobalt Strike
39[.]104[.]25[.]164:443Cobalt Strike
Sources: abuse.ch ThreatFox (keyless active-indicator export), CISA KEV, FIRST EPSS, NIST NVD, geo via ipwho.is. «Not listed» does not mean «safe».