Ransomware needs a way in. Stolen credentials are the cheapest one.
IOCs Feed
Hashes, IPs, domains, URLs from active ransomware campaigns
Indicators of compromise (IOCs) are file hashes, IP addresses, domains, and URLs observed in real ransomware attacks — security teams use them to detect, block, and hunt for the same infrastructure and malware across their own environment. This feed lists IOCs collected from active ransomware campaigns, attributed to the group and leak site that used them where known.
Total Indicators
56,948
hashes, IPs, domains, URLs
Ransomware Groups
300
with IOCs
IOC Types
4
hash, IP, domain, etc.
IOC charts
IOCs by Type
Share of indicators by type (hash, IP, domain, etc.).
40.7%
hash
hash
Share 40.7%hostname
Share 34.4%ip
Share 20%url
Share 4.9%Data may be capped by source.
Ransomware Incidents by Month
Victim counts by month (attack/discovery date). Last 12 months.
| Ransomware group | Type | Value | Copy |
|---|---|---|---|