Skip to content

Public IOC feed / Exploit delivery

Exploit delivery

Exploit kits and servers that deliver or launch exploits.

51 high-confidence indicators from the last 30 days of security reporting. Free, refreshed hourly, no login, CC-BY.

Files

With an API key: /api/public/v1/iocs/feed?category=exploit. API reference

Newest indicators

Showing 51 of 51.

  • 130.94.67.235 ipv4, 30 Oct

    Exposed IP address for a custom heap exploit. Source

  • 13slist.com domain, 30 Oct

    Listed in a YARA rule for detecting threat activity. Source

  • arabtechmessenger.net domain, 30 Oct

    Listed in a YARA rule for detecting threat activity. Source

  • communityrespondalarm.com domain, 30 Oct

    Listed in a YARA rule for detecting threat activity. Source

  • rapidcomments.com domain, 30 Oct

    Listed in a YARA rule as a domain associated with threat activity. Source

  • zimbrasoft.com.ua domain, 30 Oct

    Listed in a YARA rule as a domain associated with threat activity. Source

  • 185.237.166.55 ipv4, 30 Oct

    Listed in a YARA rule for detecting threat activity. Source

  • utaq.cfww.shop domain, 29 Oct

    Domain used for exploit modules and C2 infrastructure. Source

  • 3x3br.eu.cc domain, 29 Oct

    Domain used in social engineering tactics to direct users to exploit environments. Source

  • ax.xoovo.top domain, 29 Oct

    Domain used to load attack code in a hidden frame while displaying legitimate content. Source

  • echomint.buzz domain, 29 Oct

    Domain used to hide exploit framework behind a decoy service. Source

  • melatibiru.win domain, 29 Oct

    Domain used to distribute DarkSword-derived exploit scripts. Source

  • ssc.vever3eds.com domain, 29 Oct

    Central staging host for exploit scripts. Source

  • 43.228.157.68 ipv4, 28 Oct

    Reported as a server used in exploitation infrastructure Source

  • 103.151.172.95 ipv4, 27 Oct

    Used in an exploit attempt against a honeypot. Source

  • 85.11.187.35 ipv4, 27 Oct

    Used in an exploitation attempt. Source

  • 7fcbdaaecd4419e2930927844f3b772668204737a4e7602a2290c991c93c5c4b sha256, 27 Oct

    Hash of a malicious payload used in an attack. Source

  • vps3749638.trouble-free.net domain, 26 Oct

    PTR record associated with a confirmed source address used in exploit attempts. Source

  • vps-b225fb62.vps.ovh.us domain, 26 Oct

    PTR record associated with a confirmed source address used in exploit attempts. Source

  • 92.118.112.100 ipv4, 22 Oct

    IP address associated with attacker-controlled scanning and exploitation attempts Source

  • 44fc9e306763774b50b61fc7487aa1d219aa288aefa201119c7bc278e17600a8 sha256, 23 Oct

    Hash of a malicious file used in an exploit Source

  • 52abb57bf6f9db815b3ddf6241e21d4096f36eb998bb51e728bbe68c0f8e8e15 sha256, 23 Oct

    Hash of a malicious file used in an exploit Source

  • 5db4ed7d07ab028ab6ceba8efec5f667d86a419020d2a8c86e90a3125aa31bb9 sha256, 23 Oct

    Listed as a file masquerading as a doc file but actually an SFX file Source

  • 8DB20544F280955ED3EF3C42DC8423E3000E244FC7C8F0E3A7567FA48F7A15D9 sha256, 23 Oct

    Hash of a malicious file used in an exploit Source

  • B937024B7484B26D09BA8130CC4AB04600DC18C976BB0C7724A063F1FC6F0D77 sha256, 23 Oct

    Hash of a malicious file used in an exploit Source

  • C8583FDDF668808E31F993FF6BCFC6F8BA8B4C2C0C4EA51D4CCC6F5D311B6C90 sha256, 23 Oct

    Hash of a malicious file used in an exploit Source

  • 154.37.213.27 ipv4, 23 Oct

    Listed in a YARA rule as exploit hosting infrastructure Source

  • 170.231.237.214 ipv4, 23 Oct

    Listed in a YARA rule as exploit hosting infrastructure Source

  • 196.189.236.67 ipv4, 23 Oct

    Listed in a YARA rule as exploit hosting infrastructure Source

  • 210.242.76.32 ipv4, 22 Oct

    IP address used in exploitation attempts originating from Taiwan. Source

  • 211.20.144.116 ipv4, 22 Oct

    IP address used in exploitation attempts originating from Taiwan. Source

  • wizardexpensive.com domain, 20 Oct

    Domain listed as part of attacker infrastructure to be blocked Source

  • 2.27.248.127 ipv4, 20 Oct

    IP address listed as part of attacker infrastructure to be blocked Source

  • 96.62.218.59 ipv4, 20 Oct

    IP address listed as part of attacker infrastructure to be blocked Source

  • f4ffef4204880031a6a532ff5c1b5686e6a301c365f492071c1d462fa5b6b4a0 sha256, 21 Oct

    Listed as a malicious PoC binary Source

  • pwnedhost.com domain, 20 Oct

    Domain used in a SQL injection attack payload Source

  • chainmate.top domain, 17 Oct

    Used in an iPhone exploit chain. Source

  • zhengxin021.top domain, 17 Oct

    Used in an iPhone exploit chain. Source

  • 185.25.50.194 ipv4, 16 Oct

    Associated with CHAINSHOT exploit kit linked to Candiru Source

  • ecomtrack.io domain, 13 Oct

    Re-registered by attackers to deliver DarkSword malware Source

  • hdios.cn domain, 9 Oct

    Hosts C2 infrastructure and exploit registry Source

  • 185.189.45.40 ipv4, 9 Oct

    Capture associated with DarkSword/Coruna kit Source

  • 23.148.212.237 ipv4, 9 Oct

    Serves as an analysis workspace for exploit development Source

  • moonlighthathel.org domain, 8 Oct

    Listed as a malicious FQDN targeted by DNS Object Block Rule Source

  • ukankingwithea.com domain, 8 Oct

    Listed as a malicious FQDN targeted by DNS Object Block Rule Source

  • 1bcaef76b2063f1b80b0fa0d277ec9c5 md5, 8 Oct

    Listed as a known file used by threat actors Source

  • 4d33bfb75e27fefaa72526899604d557 md5, 8 Oct

    Listed as a known file used by threat actors Source

  • fc6e8ca41cf4f6100177352660e520b4 md5, 8 Oct

    Listed as a known file used by threat actors Source

  • 644decbc6ce8c52382f4755fa6fc2cb4d89a0e7ec0e574c11b398a6f2eed04b1 sha256, 8 Oct

    Listed as a known file used by threat actors Source

  • 67db57a1f957031b78f29aa91e2e87780eae3835290259eff846d8f14afb794b sha256, 8 Oct

    Listed as a known file used by threat actors Source

  • 156.239.230.120 ipv4, 8 Oct

    Hosts exploit server and C2 platform for DarkSword operations Source

Think one of these is wrong? Email [email protected].

Other categories