Home / Threat intelligence
IOC Radar
Paste an indicator — IP, domain, URL, or MD5/SHA-1/SHA-256 hash — to see whether it appears in abuse.ch public threat feeds. Defanged formats (hxxp, [.]) are accepted.
What each source covers
- ThreatFox — Malware IOCs: C2 IP:ports, domains, URLs and hashes, with family and confidence.
- URLhaus — URLs used to distribute malware, by URL or by host.
- MalwareBazaar — Malware samples by hash (MD5, SHA-1, SHA-256), with signature and file type.
Indicators are shown defanged (hxxp, [.]) and never as links. Do not open malicious URLs outside an isolated environment.
Privacy: we keep only a hash of the looked-up indicator, along with the result, for up to 6 hours (cache). Do not submit sensitive internal data.
Data: abuse.ch — ThreatFox, URLhaus and MalwareBazaar (CC0).