Do we know this indicator?
785,079 indicatorsupdated 18 Oct 2026 18:46 UTCfeeds and cited reports
Paste anything: a log excerpt, an email header, a list of IPs, a phishing report. You get the IPs, domains, URLs and file hashes we hold, what each one is said to be, how sure we are, and which named threat actor a report links it to. Scanner and brute-force noise is labelled as noise, not as malware.
How to read an answer
- Malware C2
- Listed as a command-and-control server for a malware family. Hosts talking to it are probably infected.
- Malware delivery
- Listed as serving malware, either a download URL or the host behind one.
- Malware file
- A file hash that malware feeds list as malicious.
- Malware-linked
- Listed by malware feeds, without saying whether it delivers, controls or is the malware.
- Phishing
- Listed by phishing feeds as a lure, a fake login or a look-alike domain.
- Compromised host
- A legitimate host that feeds report as taken over. Block with care.
- Scanner / brute-force noise
- Seen scanning or guessing passwords across the internet. Common background noise, not proof of a targeted attack.
- On a blocklist
- Listed by one or more reputation feeds that do not say what it did.
- Named in a report
- No feed lists it, but a published threat report names it.
- Confidence runs 0 to 100. It rises when several independent feeds list the same indicator, and falls for shared infrastructure such as hosting ranges. Below 40 the verdict is worded as "possible".
- Not in our data is not safe. A new or targeted indicator will not be listed yet.
- Via host, via parent domain. When a URL itself is unknown but its host is listed, or a subdomain is unknown but its parent domain is, the row says so.
- Actors appear only when a published report names the indicator, with the quoted sentence and a link to the report.
- Vendor, press and private addresses are skipped, and everything on this page is shown defanged. Your text goes to our server for the lookup and is not stored.
Blocklists
The same data as plain text, one value per line, for a firewall or a SIEM. Confidence 80 or more, seen in the last 7 days, scanner and brute-force feeds left out. These files hold real values, not defanged ones.
- IP addressesC2 servers, malware hosts and phishing hoststxt · csv
- Domainsphishing and malware domainstxt · csv
- URLsmalware downloads and phishing pagestxt · csv
- SHA256 hashesmalware filestxt · csv
Options: min=20..100 · days=1|7|30 · noise=1 to keep scanner feeds · up to 100,000 lines · md5 and sha1 too.
API: POST /api/v1/ioc/check · GET /api/v1/ioc/{indicator} · docs · JSON · no key