IOCs by window
0
IOCs tagged #opendir
2
IOCs tagged #opendir
38
IOCs tagged #opendir
707
IOCs tagged #opendir
Counts as of 2026-10-28. Regenerated daily.
About #opendir
- Definition: Web folder with directory autoindex on. Anyone can list its files.
- Attacker use: Staging servers, kit drops and panel roots can show payloads and scripts.
- Why track: High-yield IOC source. One opendir often holds multiple loaders and payloads.
- Defenders: Scan egress for Index of / patterns.
- Hunters: ODIN by The DFIR Report, URLscan tag filters, certificate-transparency sweeps.
- References: MITRE ATT&CK T1190 · The DFIR Report.
Recent IOCs tagged #opendir
Latest 10 IOCs from the past 30 days. Live JSON: api.tweetfeed.live/v1/month/opendir.
| Date | Type | Value | Source |
|---|---|---|---|
| ip | |||
| url | |||
| ip | |||
| ip | |||
| ip | |||
| ip | |||
| ip | |||
| ip | |||
| ip | |||
| url |
Related tags
Frequently asked questions
What is an opendir?
A web folder with directory autoindex on, so its files show as a list. Researchers can browse it and download every artefact.
How do opendirs end up in this feed?
Researchers post attacker opendir URLs tagged #opendir, and TweetFeed republishes them in CSV, JSON and RSS within 15 minutes. Many are short-lived.
How is this list updated?
The feed and the API update every 15 minutes from researcher posts on X. This page refreshes once a day.
What is the license? Can I use this commercially?
Yes. All IOC data, including this Opendir subset, is CC0 1.0 Universal. No attribution needed. No warranty. The website code and branding are not CC0.
License
Opendir IOC data: CC0 1.0 Public Domain. No attribution required, no warranty.