#malvertising

Malicious ads that redirect victims to phishing pages or malware

Subscribe (RSS)


#malvertising

Malicious ads leading to phishing or malware

Subscribe (RSS)

IOCs by window

Today

0

IOCs tagged #malvertising

Week

0

IOCs tagged #malvertising

Month

290

IOCs tagged #malvertising

Year

371

IOCs tagged #malvertising

Counts as of 2026-11-12. Regenerated daily.

About #malvertising

  • Definition: Abuse of ad platforms to spread malicious content. MITRE ATT&CK T1583.008.
  • How: Attacker buys or injects a real-looking ad. A click redirects to attacker servers.
  • Where: Search ads for popular software, busy-site display ads, weakly vetted ad networks.
  • Lands on: A cloned download page or an exploit page, not the real vendor.
  • Evasion: Often cloaked: ad review crawlers see a benign page, real visitors get redirected.
  • References: MITRE ATT&CK T1583.008.

Recent IOCs tagged #malvertising

Latest 10 IOCs from the past 30 days. Live JSON: api.tweetfeed.live/v1/month/malvertising.

Date Type Value Source
Oct 24, 17:06 domain flixarena.cyou @Malwarehunterr
Oct 24, 17:06 url http://flixarena.cyou @Malwarehunterr
Oct 24, 17:06 domain flixbaba-offcial.cyou @Malwarehunterr
Oct 24, 17:06 url http://flixbaba-offcial.cyou @Malwarehunterr
Oct 24, 17:06 domain flixbeam.cyou @Malwarehunterr
Oct 24, 17:06 url http://flixbeam.cyou @Malwarehunterr
Oct 24, 17:06 domain flixblast.cyou @Malwarehunterr
Oct 24, 17:06 url http://flixblast.cyou @Malwarehunterr
Oct 24, 17:06 domain flixboom.cyou @Malwarehunterr
Oct 24, 17:06 url http://flixboom.cyou @Malwarehunterr

Related tags

Often seen with #malvertising.

See all tags on the Dashboard or browse the full IOC feed.

Frequently asked questions

What is malvertising?

Abuse of online advertising to spread malicious content. A fake ad redirects the victim to a phishing page, a cloned download site or a drive-by exploit.

How is malvertising different from a compromised website?

A compromised site means the attacker changed a real site's code. Malvertising abuses an ad platform to put bad content on many other sites, and the two are often chained.

How is this list updated?

The feed and the API update every 15 minutes from researcher posts on X. This page refreshes once a day.

What is the license? Can I use this commercially?

Yes. All IOC data, including this Malvertising subset, is CC0 1.0 Universal. No attribution needed. No warranty. The website code and branding are not CC0.

License

Malvertising IOC data: CC0 1.0 Public Domain. No attribution required, no warranty.