#malvertising

Malicious ads that redirect victims to phishing pages or malware

Subscribe (RSS)


#malvertising

Malicious ads leading to phishing or malware

Subscribe (RSS)

IOCs by window

Today

0

IOCs tagged #malvertising

Week

0

IOCs tagged #malvertising

Month

22

IOCs tagged #malvertising

Year

81

IOCs tagged #malvertising

Counts as of 2026-10-22. Regenerated daily.

About #malvertising

  • Definition: Abuse of ad platforms to spread malicious content. MITRE ATT&CK T1583.008.
  • How: Attacker buys or injects a real-looking ad. A click redirects to attacker servers.
  • Where: Search ads for popular software, busy-site display ads, weakly vetted ad networks.
  • Lands on: A cloned download page or an exploit page, not the real vendor.
  • Evasion: Often cloaked: ad review crawlers see a benign page, real visitors get redirected.
  • References: MITRE ATT&CK T1583.008.

Recent IOCs tagged #malvertising

Latest 10 IOCs from the past 30 days. Live JSON: api.tweetfeed.live/v1/month/malvertising.

Date Type Value Source
Oct 12, 06:19 domain balladcompass11.com @masaomi346
Oct 12, 06:19 url http://balladcompass11.com @masaomi346
Oct 09, 13:25 domain lake-90.com @masaomi346
Oct 09, 13:25 url http://lake-90.com @masaomi346
Oct 07, 13:43 domain teams-microsoft-downloads.com @hey_shi1
Oct 07, 13:43 url http://teams-microsoft-downloads.com @hey_shi1
Oct 07, 13:43 domain update.zip @hey_shi1
Oct 07, 13:43 url http://update.zip @hey_shi1
Oct 07, 13:43 domain adserverworkshub.com @hey_shi1
Oct 07, 13:43 url http://adserverworkshub.com @hey_shi1

Related tags

Often seen with #malvertising.

See all tags on the Dashboard or browse the full IOC feed.

Frequently asked questions

What is malvertising?

Abuse of online advertising to spread malicious content. A fake ad redirects the victim to a phishing page, a cloned download site or a drive-by exploit.

How is malvertising different from a compromised website?

A compromised site means the attacker changed a real site's code. Malvertising abuses an ad platform to put bad content on many other sites, and the two are often chained.

How is this list updated?

The feed and the API update every 15 minutes from researcher posts on X. This page refreshes once a day.

What is the license? Can I use this commercially?

Yes. All IOC data, including this Malvertising subset, is CC0 1.0 Universal. No attribution needed. No warranty. The website code and branding are not CC0.

License

Malvertising IOC data: CC0 1.0 Public Domain. No attribution required, no warranty.