Public IOC feed / Phishing

Phishing

Sites that harvest credentials or impersonate a brand or person.

184 high-confidence indicators from the last 30 days of security reporting. Free, refreshed hourly, no login, CC-BY.

Files

• feed.json everything, with reasons and sources
• domains.txt 170 domains, one per line
• domains.csv with metadata
• ips.txt 5 IPs, one per line
• ips.csv with metadata
• hashes.txt 9 hashes, one per line
• hashes.csv with metadata
• RSS new indicators

With an API key: /api/public/v1/iocs/feed?category=phishing. API reference

Newest indicators

Showing 100 of 184.

• trastwallet.cam domain, 5 Nov

  Identified as a phishing domain impersonating Trust Wallet, attacker-controlled. Source

• scigovjudicial.com domain, 4 Nov

  Identified as a fraudulent domain used for phishing, impersonating the Supreme Court of India. Source

• ad111858f73ef39e955ea4a6cdc83d92b53d5ca0248a94095ff0448c7b147e29 sha256, 3 Nov

  Identified as a secondary credential-harvesting payload hash Source

• felixfuturenext.com domain, 2 Nov

  Domain used in phishing and malware attacks Source

• korektell.com domain, 2 Nov

  Used in campaigns to compromise carriers with region-specific infrastructure. Source

• mfakuwait.online domain, 2 Nov

  Used for credential phishing and malware delivery. Source

• moelcloud.online domain, 2 Nov

  Used for credential phishing and malware delivery. Source

• plantabird.com domain, 1 Nov

  Used in a phishing scam as reported Source

• account-confirm.top domain, 31 Oct

  Listed as a malicious domain used in attacks within the Shopify ecosystem Source

• billing-confirm.top domain, 31 Oct

  Listed as a malicious domain used in attacks within the Shopify ecosystem Source

• checkout-guard.top domain, 31 Oct

  Identified as a malicious domain in the investigation Source

• checkout-secure.top domain, 31 Oct

  Listed as a malicious domain used in attacks within the Shopify ecosystem Source

• betasignaltradingviewai.app domain, 29 Oct

  Domain used in a campaign to lure traders with fake TradingView videos, indicating attacker control. Source

• bank.boeahk.com domain, 30 Oct

  Listed as a fraudulent website used in phishing scams Source

• bank-heurosas.com domain, 30 Oct

  Listed as a fraudulent website used in phishing scams Source

• boc.tearwhereh.cfd domain, 30 Oct

  Domain used for fraudulent banking login screens Source

• carousell.casoruese.cc domain, 30 Oct

  Domain used for fraudulent banking login screens Source

• carousell.market-receive.bond domain, 30 Oct

  Domain used for fraudulent banking login screens Source

• carousell.market-receive.club domain, 30 Oct

  Domain used for fraudulent banking login screens Source

• carousell.market-receive.sbs domain, 30 Oct

  Domain used for fraudulent banking login screens Source

• carousell.market-receive.xyz domain, 30 Oct

  Domain used for fraudulent banking login screens Source

• carousell.money-quick.cfd domain, 30 Oct

  Domain used for fraudulent banking login screens Source

• carousell.money-quick.cyou domain, 30 Oct

  Domain used for fraudulent banking login screens Source

• carousell.money-quick.me domain, 30 Oct

  Domain used for fraudulent banking login screens Source

• carousell.money-receive.digital domain, 30 Oct

  Domain used for fraudulent banking login screens Source

• carousell.money-receive.fun domain, 30 Oct

  Domain used for fraudulent banking login screens Source

• carousell.money-receive.info domain, 30 Oct

  Domain used for fraudulent banking login screens Source

• carousell.quick-market.asia domain, 30 Oct

  Domain used for fraudulent banking login screens Source

• carousell.quick-market.cc domain, 30 Oct

  Domain used for fraudulent banking login screens Source

• carousell.quick-market.sbs domain, 30 Oct

  Domain used for fraudulent banking login screens Source

• carousell.quick-money.shop domain, 30 Oct

  Domain used for fraudulent banking login screens Source

• carousell.quick-shop.cyou domain, 30 Oct

  Domain used for fraudulent banking login screens Source

• carousell.quick-shop.shop domain, 30 Oct

  Domain used for fraudulent banking login screens Source

• carousellref.market-receive.bond domain, 30 Oct

  Domain used for fraudulent banking login screens Source

• carousellref.money-receive.fun domain, 30 Oct

  Domain used for fraudulent banking login screens Source

• carousellref.quick-market.cc domain, 30 Oct

  Domain used for fraudulent banking login screens Source

• carousellref.quick-shop.shop domain, 30 Oct

  Domain used for fraudulent banking login screens Source

• carousellref.shop-alipay.lat domain, 30 Oct

  Domain used for fraudulent banking login screens Source

• carousell.service-shop.click domain, 30 Oct

  Domain used for fraudulent banking login screens Source

• carousell.service-shop.sbs domain, 30 Oct

  Domain used for fraudulent banking login screens Source

• carousell.service-shop.top domain, 30 Oct

  Domain used for fraudulent banking login screens Source

• carousell.shop-alipay.click domain, 30 Oct

  Domain used for fraudulent banking login screens Source

• carousell.shop-oniine.sbs domain, 30 Oct

  Domain used for fraudulent banking login screens Source

• carousell.shop-pay.bond domain, 30 Oct

  Domain used for fraudulent banking login screens Source

• carousell.shop-pay.cyou domain, 30 Oct

  Domain used for fraudulent banking login screens Source

• carousell.shop-service.cyou domain, 30 Oct

  Domain used for fraudulent banking login screens Source

• carousell.shopservice.cyou domain, 30 Oct

  Domain used for fraudulent banking login screens Source

• carousell.shop-service.top domain, 30 Oct

  Domain used for fraudulent banking login screens Source

• com.bankofsingapore.digital domain, 30 Oct

  Domain used for fraudulent mobile applications Source

• juliusbarassetsmanagement.com domain, 30 Oct

  Domain used for fraudulent websites Source

• misonla.com domain, 30 Oct

  Domain used for phishing emails Source

• shop-service.icu domain, 30 Oct

  Domain used for fraudulent banking login screens Source

• uat.byjuliusbaer.top domain, 30 Oct

  Domain used for fraudulent websites Source

• ziv7do56.llttbwx.top domain, 30 Oct

  Domain used for fraudulent websites Source

• cancelcardprotection.online domain, 30 Oct

  Used in phishing campaigns targeting bank customers Source

• cancelcpservice.in domain, 30 Oct

  Used in phishing campaigns targeting bank customers Source

• cardprotections.in domain, 30 Oct

  Used in phishing campaigns targeting bank customers Source

• install-update.xyz domain, 30 Oct

  Used in phishing campaigns targeting bank customers Source

• 78.159.156.74 ipv4, 30 Oct

  Listed as an IP address used in a phishing campaign. Source

• goo.gle-access-eventregister.icu domain, 29 Oct

  Phishing domain mimicking Google login page Source

• us968web-zoom.us domain, 29 Oct

  Phishing domain mimicking Zoom meeting page Source

• 3x3br.eu.cc domain, 29 Oct

  Domain used in social engineering tactics to direct users to exploit environments. Source

• echomint.buzz domain, 29 Oct

  Domain used to hide exploit framework behind a decoy service. Source

• shopcredit.xyz domain, 29 Oct

  Flagged as a phishing URL in a fraudulent recruitment scam Source

• onverinusinesscommunicationscente.org domain, 28 Oct

  Identified as attacker-controlled domain in phishing campaign Source

• free-secure.com domain, 28 Oct

  Identified as distributing MiningDropper malware Source

• www.kavoutai.com domain, 28 Oct

  Identified as distributing MiningDropper malware Source

• 58a94f889547db8b2327a62e03fb2cce3bda716278d645ee8094178ecda2e9e6 sha256, 28 Oct

  Hash of a malicious APK distributed via a phishing site Source

• adacompliantsigns.online domain, 27 Oct

  Part of a phishing campaign infrastructure. Source

• chapalasrealtor.com domain, 27 Oct

  Part of a phishing campaign infrastructure. Source

• met.macroteams.site domain, 27 Oct

  Part of a phishing campaign infrastructure. Source

• loradmiadministraciones.com domain, 25 Oct

  Domain used in a phishing scam impersonating a government agency. Source

• jakang.freewebhostmost.com domain, 24 Oct

  Phishing page hosting domain identified in the article Source

• 03d3e9c54028780d2ff15c654d7a7e70973453d2fae8bdeebf5d9dbb10ff2eab sha256, 24 Oct

  Listed as a SHA256 hash of a malicious JavaScript sample Source

• 3f0b95f96a8f28631eb9ce6d0f40b47220b44f4892e171ede78ba78bd9e293ef sha256, 24 Oct

  Listed as a SHA256 hash of malicious JavaScript samples Source

• 4f1eb707f863265403152a7159f805b5557131c568353b48c013cad9ffb5ae5f sha256, 24 Oct

  Listed as a SHA256 hash of a malicious JavaScript sample Source

• choclatey.org domain, 23 Oct

  Typosquatted domain impersonating Chocolatey Source

• 82.153.135.80 ipv4, 23 Oct

  Used to host fake Chocolatey and Massgrave lure websites Source

• bnt2.live domain, 22 Oct

  Described as an actor-controlled URL shortener used for credential harvesting Source

• gettogether.quest domain, 22 Oct

  Used in a TA453 campaign to deliver threatening messages Source

• nco2.live domain, 22 Oct

  Described as an actor-controlled URL shortener used for credential harvesting Source

• profilepic.site domain, 22 Oct

  Attributed to TA453 based on registration similarities Source

• my-github.com domain, 19 Oct

  Registered by the threat actor for phishing and data exfiltration. Source

• oskeysetup.com domain, 22 Oct

  Domain used for phishing and adversary-in-the-middle attacks Source

• mosaichealthsolutions.com domain, 22 Oct

  Described as an attacker-controlled domain for credential harvesting Source

• thebesthomehealth.com domain, 22 Oct

  Described as an attacker-controlled domain for credential harvesting Source

• simba.sg-recharge.cfd domain, 21 Oct

  Phishing domain impersonating a legitimate site Source

• simba.sg-recharge.cyou domain, 21 Oct

  Phishing domain impersonating a legitimate site Source

• amazonyt.com domain, 21 Oct

  Hosted site impersonating Amazon services Source

• youtubechannelverification.com domain, 21 Oct

  Used in a phishing scheme to collect credentials Source

• orders-amazon-com.advancedfences.com domain, 21 Oct

  Used in a phishing campaign with a fake Amazon login page Source

• orders-amazon.com.advancedfences.com domain, 21 Oct

  Used in a phishing campaign with a fake Amazon login page Source

• pavpal.com domain, 21 Oct

  Identified as a typosquatted domain used for phishing, mimicking paypal.com Source

• secure-account-help.co domain, 21 Oct

  Phishing domain used to collect credentials Source

• javadevhouse.co.kr domain, 21 Oct

  Used to host malicious JavaScript linked to phishing emails Source

• pythonapischool.com domain, 21 Oct

  Used to host malicious JavaScript linked to phishing emails Source

• 212.73.134.136 ipv4, 20 Oct

  Used as a source IP for phishing activity Source

• msauth.biz domain, 20 Oct

  Newly registered domain used for phishing, controlled by attacker Source

• wp-mail.net domain, 17 Oct

  Domain used in malicious email addresses for unauthorized administrator accounts Source

• 68c20885a3e234c9eb1e4f87a7013298923646f9c50dfdad97a9e35d989119f8 sha256, 19 Oct

  Listed as a malicious script hash in a threat report Source

Think one of these is wrong? Email [email protected].