IOCs Feed
Hashes, IPs, domains, URLs from active ransomware campaigns
Indicators of compromise (IOCs) are file hashes, IP addresses, domains, and URLs observed in real ransomware attacks — security teams use them to detect, block, and hunt for the same infrastructure and malware across their own environment. This feed lists IOCs collected from active ransomware campaigns, attributed to the group and leak site that used them where known.
Total Indicators
52,738
hashes, IPs, domains, URLs
Ransomware Groups
258
with IOCs
IOC Types
4
hash, IP, domain, etc.
IOC charts
IOCs by Type
Share of indicators by type (hash, IP, domain, etc.).
44.9%
hash
hash
Share 44.9%hostname
Share 28.7%ip
Share 21.1%url
Share 5.3%Data may be capped by source.
Ransomware Incidents by Month
Victim counts by month (attack/discovery date). Last 12 months.
52,738 total
| Ransomware group | Type | Value | Copy |
|---|---|---|---|
| lockbit2 | ip | 192.42.116.191 | |
| lockbit2 | hash | bcbb1e388759eea5c1fbb4f35c29b6f66f3f4ca4c715bab35c8fc56dcf3fa621 | |
| lockbit2 | hash | dbfb478d52b870bb39d75faa7401c7a7b06e8e88b34ae050d02ff8a0e7545e86 | |
| lockbit2 | hash | dc3d08480f5e18062a0643f9c4319e5c3f55a2e7e93cd8eddd5e0c02634df7cf | |
| lockbit2 | hash | ffa0420c10f3d0ffd92db0091304f6ed60a267f747f4420191b5bfe7f4a513a9 | |
| lockbit2 | hash | fc8668f6097560f79cea17cd60b868db581e51644b84f5ad71ba85c00f956225 | |
| lockbit2 | hash | ac49a9ecd0932faea3659d34818a8ed4c48f40967c2f0988eeda7eb089ad93ca | |
| lockbit2 | hash | 924ec909e74a1d973d607e3ba1105a17e4337bd9a1c59ed5f9d3b4c25478fe11 | |
| lockbit2 | hash | 7509761560866a2f7496eb113954ae221f31bc908ffcbacad52b61346880d9f3 | |
| lockbit2 | hash | 5c5c5b25b51450a050f4b91cd2705c8242b0cfc1a0eaeb4149354dbb07979b83 | |
| lockbit2 | hash | 32eb4b7a4d612fac62e93003811e88fbc01b64281942c25f2af2a0c63cdbe7fa | |
| lockbit2 | hash | 102679330f1e2cbf41885935ceeb2ab6596dae82925deec1aff3d90277ef6c8c | |
| lockbit2 | hash | a0b36376ab6c54540d10e5d549049622096d121abec6f760e0452a535c1675f3 | |
| lockbit2 | hash | 0be6f1e927f973df35dad6fc661048236d46879ad59f824233d757ec6e722bde | |
| lockbit2 | hash | 624188b7b839afe83d2cc6593448b73e94c40085671f967846ac3901c9f75249 | |
| lockbit2 | hash | 052716d193fc11c2f0deb67e35e580db335368d53cdd486f9cb1598c7021be8e | |
| lockbit2 | hash | f35ba7686462a868a90bb8d9567e42e34064f91f54aeb5ed74b0d0b0e19badac | |
| lockbit2 | hash | 897b23cc1af331a972da64e298163fbe0f1fd4d6bd983d452a889c1d285a1a27 | |
| lockbit2 | hash | ce8559871b410e23057393eb2d9fb76ec902da2ff1f8006ad312c81852a41f6f | |
| lockbit2 | hash | a08fbf01d02097094b725101309b2bf7fefc2e27724654b840b87e091aa5c9b9 | |
| lockbit2 | ip | 81.19.135.219 | |
| lockbit2 | ip | 185.17.40.178 | |
| lockbit2 | hostname | decoding.at | |
| lockbit2 | hostname | twitter3e4tixl4xyajtrzo62zg5vztmjuricljdp2c5kshju4avyoid.onion | |
| lockbit2 | hostname | lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion | |
| lockbit2 | ip | 185.104.194.134 | |
| lockbit2 | hash | 1dab85cf02cf61de30fcda209c8daf15651d649f32996fb9293b71d2f9db46e1 | |
| lockbit2 | hostname | tinneatonenessnabobical.com | |
| lockbit2 | hash | 0cc54ffd005b4d3d048e72f6d66bcc1ac5a7a511ab9ecf59dc1d2ece72c69e85 | |
| lockbit2 | hash | f3a1576837ed56bcf79ff486aadf36e78d624853e9409ec1823a6f46fd0143ea | |
| lockbit2 | hash | 3f97e112f0c5ddf0255ef461746a223208dc0846bde2a6dca9c825d9c706a4e9 | |
| lockbit2 | hostname | lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion | |
| lockbit2 | hash | c597c75c6b6b283e3b5c8caeee095d60902e7396536444b59513677a94667ff8 | |
| lockbit2 | hash | 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2 | |
| lockbit2 | hostname | ppaauuaa11232.cc | |
| lockbit2 | hash | 0545f842ca2eb77bcac0fd17d6d0a8c607d7dbc8669709f3096e5c1828e1c049 | |
| lockbit2 | hash | 4bb152c96ba9e25f293bbc03c607918a4452231087053a8cb1a8accb1acc92fd | |
| lockbit2 | hash | 4edbf2358a9820e030136dc76126c20cc38159df0d8d7b13d30b1c9351e8b277 | |
| lockbit2 | hash | 717585e9605ac2a971b7c7537e6e311bab9db02ecc6451e0efada9b2ff38b474 | |
| lockbit2 | hash | a7591e4a248c04547579f014c94d7d30aa16a01bb2a25b77df36e30a198df108 | |
| lockbit2 | hash | acad2d9b291b5a9662aa1469f96995dc547a45e391af9c7fa24f5921b0128b2c | |
| lockbit2 | hash | b3faf5d8cbc3c75d4c3897851fdaf8d7a4bd774966b4c25e0e4617546109aed5 | |
| lockbit2 | hostname | bigblog.at | |
| lockbit2 | hostname | lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion | |
| lockbit2 | hostname | lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion | |
| lockbit2 | hostname | info.openjdklab.xyz | |
| lockbit2 | hostname | lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion | |
| lockbit2 | hostname | lockbit7z2jwcskxpbokpemdxmltipntwlkmidcll2qirbu7ykg46eyd.onion | |
| lockbit2 | hash | 2e62c9850f331799f1e4893698295d0b069ab04529a6db1bfc4f193fe6aded2c | |
| lockbit2 | hash | e02b3309c0b6a774a4d940369633e395b4c374dc3e6aaa64410cc33b0dcd67ac |
Showing 1–50 of 52,738
Page 1 of 1055