IOC types

Per-type landing pages: URLs, domains, IPs, MD5, SHA-256

IOC types

5 per-type landing pages

Per-type streams

Pick a type. Each page has live counts, recent samples and a FAQ.

url Malicious URLs

Full links with path and query. Our biggest feed.

domain Malicious domains

Host names only. Good for DNS blocklists.

ip Malicious IPs

IPv4 addresses of C2 and scanner hosts. Block with care.

Legacy 128-bit file hashes. Check them in VirusTotal.

sha256 SHA-256 hashes

256-bit file hashes. Better than MD5 for evidence.

Other reference

Tag index: 26 pages for APT groups, malware and TTPs.
Threat Intelligence guide: IOC types, OSINT vs paid feeds, ATT&CK basics.