Threat intelligence feed
Lokibot IOC Feed
Lokibot is an information-stealing trojan. PrecisionSec's curated Lokibot feed tracks active C2 and distribution infrastructure in real time.
15-day free trial · no credit card · reply within one business day
Drops straight into the tools your SOC already runs
What is Lokibot?
Lokibot is an information-stealing trojan that steals usernames, passwords, cryptocurrency wallets and other credentials from browsers, email and FTP clients.
It is usually delivered through spear-phishing attachments, and the stolen VPN or login credentials frequently become the foothold for a later ransomware attack.
Why track it with PrecisionSec
Credential theft that escalates to ransomware
Lokibot harvests the VPN and login credentials attackers reuse for initial access, so blocking it closes that door early.
Cut commodity-malware noise
High-confidence classification lets your SOC filter mass-distributed crimeware and focus on targeted, hands-on threats.
Built for your stack
Lokibot C2 and distribution indicators are delivered in the formats your existing security tools already speak.
Delivered via STIX/TAXII, MISP, CSV and REST API. Lokibot C2 and distribution IOCs are included in every PrecisionSec intelligence subscription. See Infostealer Intelligence for malware hashes and infrastructure IOCs across the infostealer activity PrecisionSec discovers.
Recent Lokibot IOCs
Live Lokibot command & control (C2) indicators, pulled straight from our threat feed and refreshed as fast as every minute. For full coverage and API delivery, sign up for a free trial.
A sample from our threat feed. For live data updated every minute, including command & control (C2) data,sign up for a free trial.
| First seen | Indicator | Type | Confidence |
|---|---|---|---|
| 3m | secure-update-cdn[.]net | C2 domain | High |
| 9m | 91.213.50[.]114 | C2 IP | High |
| 15m | api-telemetry-sync[.]com/load | Payload URL | High |
| 22m | b7e2f48c…3d90af | SHA256 Hash | Medium |
| 38m | node-relay-7f1c[.]org | C2 domain | High |
Ready to see all of our data?
Start your 15-day free trial and get the full Lokibot feed, plus every other malware and C2 feed.