1<!doctype html> 2<html lang="en"> 3<head> 4<meta charset="utf-8"> 5<meta name="robots" content="all" /> 6<meta name="description" content="abuse.ch | Fighting malware and botnets" /> 7<meta name="keywords" content="abuse.ch, malware, botnets, security, statistic, projects, trojan, blog, infosec, cyber, threat, intelligence" /> 8<link rel="stylesheet" href="css/bootstrap.min.css" type="text/css"> 9<link rel="stylesheet" href="css/custom.css" type="text/css"> 10<link rel="shortcut icon" type="image/x-icon" href="favicon.ico" /> 11<link rel="alternate" type="application/rss+xml" title="abuse.ch | IT-Security Blog" href="/rss/" /> 12<title>abuse.ch | Fighting malware and botnets</title> 13<meta name="viewport" content="width=device-width, initial-scale=1"> 14<!-- Twitter Card --> 15<meta name="twitter:card" content="summary"> 16<meta name="twitter:title" content="abuse.ch - Figthing malware and botnets"> 17<meta name="twitter:description" content="abuse.ch is providing community driven threat intelligence on cyber threats"> 18<meta name="twitter:url" content="https://abuse.ch/"> 19<meta name="twitter:image" content="https://abuse.ch/images/abusech_twitter.png"> 20<meta name="twitter:site" content="@abuse_ch"> 21<meta name="twitter:creator" content="@abuse_ch"> 22<!-- Google Analytics -->
vendor: 64 bytes, lines 22-23
22 23<script async src="https://www.googletagmanager.com/gtag/js?id=
23G-MZSJ4F05DR
vendor: 12 bytes, line 23
23"></script>
24<script>
vendor: 128 bytes, lines 25-29
25window.dataLayer = window.dataLayer || []; 26function gtag(){dataLayer.push(arguments);} 27gtag('js', new Date()); 28 29gtag('config', '
29G-MZSJ4F05DR
vendor: 4 bytes, line 29
29');
30</script>
30 31</head> 32<body> 33 34 <!-- Load jquery, bootstrap and Google Charts --> 35
35<script src="js/jquery-3.6.0.min.js"></script>
35 36
36<script src="js/bootstrap.min.js"></script>
36 37
37<script src="js/google-charts.js"></script>
37 38 39 <!-- Prepare Google charts for #statistics --> 40
40<script> 41 window.onload = function () { 42 google.charts.load('current', {packages: ['corechart', 'line', 'bar']}); 43 google.charts.setOnLoadCallback(drawSandnetChart); 44 45 function drawSandnetChart() { 46 var data = new google.visualization.DataTable(); 47 <!-- Define colums --> 48 data.addColumn('string', 'Date'); 49 data.addColumn('number', 'Number of analysed malware samples'); 50 51 <!-- Fill columns with data --> 52 data.addRows([ 53 ["2026-08-25", 13153], 54["2026-08-26", 10887], 55["2026-08-27", 13652], 56["2026-08-28", 12282], 57["2026-08-29", 12084], 58["2026-08-30", 11156], 59["2026-08-31", 11573], 60["2026-09-01", 10400], 61["2026-09-02", 11278], 62["2026-09-03", 11134], 63["2026-09-04", 12314], 64["2026-09-05", 10141], 65["2026-09-06", 9182], 66["2026-09-07", 11638], 67["2026-09-08", 12542], 68["2026-09-09", 9947], 69["2026-09-10", 12073], 70["2026-09-11", 12079], 71["2026-09-12", 7360], 72["2026-09-13", 12586], 73["2026-09-14", 9949], 74["2026-09-15", 8231], 75["2026-09-16", 11439], 76["2026-09-17", 11646], 77["2026-09-18", 8945], 78["2026-09-19", 8532], 79["2026-09-20", 11138], 80["2026-09-21", 8687], 81["2026-09-22", 14694], 82["2026-09-23", 10982], 83 84 ]); 85 86 <!-- Chart options --> 87 var options = { 88 chartArea:{top:5}, 89 titleFontSize: '16', 90 vAxis: { 91 textStyle:{color: '#767676'}, 92 gridlines: { 93 count: 10 94 } 95 }, 96 hAxis: { 97 textStyle:{color: '#767676'} 98 }, 99 legend: { position: 'bottom' }, 100 colors: ['#578cb4'] 101 }; 102 103 <!-- Generate chart --> 104 var chart = new google.visualization.LineChart(document.getElementById('sandnet_samples')); 105 106 <!-- Draw chart --> 107 chart.draw(data, options); 108 } 109 110google.charts.setOnLoadCallback(drawSpamStats); 111 function drawSpamStats() { 112 var data = new google.visualization.DataTable(); 113 data.addColumn('string', 'Date'); 114 data.addColumn('number', 'Spam mails'); 115 116 data.addRows([ 117 ["2026-08-25", 48212], 118["2026-08-26", 48865], 119["2026-08-27", 48048], 120["2026-08-28", 40966], 121["2026-08-29", 26981], 122["2026-08-30", 27515], 123["2026-08-31", 45185], 124["2026-09-01", 52492], 125["2026-09-02", 64921], 126["2026-09-03", 62292], 127["2026-09-04", 53532], 128["2026-09-05", 38719], 129["2026-09-06", 38371], 130["2026-09-07", 57323], 131["2026-09-08", 42163], 132["2026-09-09", 45370], 133["2026-09-10", 51003], 134["2026-09-11", 40571], 135["2026-09-12", 29924], 136["2026-09-13", 33215], 137["2026-09-14", 44320], 138["2026-09-15", 51233], 139["2026-09-16", 48441], 140["2026-09-17", 36423], 141["2026-09-18", 33775], 142["2026-09-19", 30635], 143["2026-09-20", 29930], 144["2026-09-21", 40127], 145["2026-09-22", 36372], 146["2026-09-23", 41005], 147 148 ]); 149 150 var options = { 151 chartArea:{top:5}, 152 titleFontSize: '16', 153 vAxis: { 154 textStyle:{color: '#767676'}, 155 gridlines: { 156 count: 10 157 } 158 }, 159 hAxis: { 160 textStyle:{color: '#767676'} 161 }, 162 legend: { position: 'bottom' }, 163 colors: ['#b05713', '#aa0337'] 164 }; 165 166 var chart = new google.visualization.AreaChart(document.getElementById('spam_stats')); 167 chart.draw(data, options); 168 } 169 170 window.onresize = function(event) { 171 drawSandnetChart(); 172 drawSpamStats(); 173 }; 174} 175 </script>
175 176 177 178<!--- Navigation --> 179<div class="sticky-top"> 180 <div class="d-flex justify-content-center align-items-center temp-banner"> 181 <div class="container d-flex justify-content-center align-items-center"> 182 <p style="margin-bottom: 0 !important; text-align: center"> 183 ð¤²ð¼ <strong>NEW</strong> | abuse.ch Community Hub! Earn recognition ð for the malware intelligence you share, climb the leaderboards ð, and connect with like-minded contributors who share your hunting focus ð¤. Ready to unlock your profile? 184 <a href="https://community.abuse.ch" target="_blank">Go to the Community Hub â</a> 185 </p> 186 </div> 187 </div> 188 <nav id="MainNavbar" class="navbar navbar-expand-lg navbar-dark"> 189 <div class="container"> 190 <a class="navbar-brand pr-3" href="/"> 191 <img src="images/abuse-ch-stec-logo-white.svg" width="100%" height="100%" alt="abuse.ch and Spamhaus Logo"> 192 </a> 193 <button class="navbar-toggler custom-toggler" type="button" data-toggle="collapse" data-target="#collapsingNavbar"> 194 <span class="navbar-toggler-icon navbar-light"></span> 195 </button> 196 <div class="navbar-collapse collapse" id="collapsingNavbar"> 197 <ul class="nav navbar-nav ml-auto w-100 justify-content-end"> 198 <li class="nav-item"> 199 <a class="nav-link" href="#about" onclick="$('#collapsingNavbar').collapse('hide');">mission</a> 200 </li> 201 <li class="nav-item"> 202 <a class="nav-link" href="#platforms" onclick="$('#collapsingNavbar').collapse('hide');">platforms</a> 203 </li> 204 <li class="nav-item"> 205 <a class="nav-link" href="#community" onclick="$('#collapsingNavbar').collapse('hide');">community</a> 206 </li> 207 <li class="nav-item"> 208 <a class="nav-link" href="blog/" onclick="$('#collapsingNavbar').collapse('hide');">blog</a> 209 </li> 210 <li class="nav-item"> 211 <a class="nav-link" href="#statistics" onclick="$('#collapsingNavbar').collapse('hide');">statistics</a> 212 </li> 213 <li class="nav-item"> 214 <a class="nav-link" href="https://contact.abuse.ch/" onclick="$('#collapsingNavbar').collapse('hide');">contact</a> 215 </li> 216 </ul> 217 </div> 218 </div> 219 </nav> 220</div> 221 222<!-- Main content --> 223<div class="jumbotron bg-img"> 224 <div class="container"> 225 <h1 class="display-4 wh mt-5"><span class="bg-dark">FIGHTING MALWARE AND BOTNETS</span></h1> 226 <p><span class="text-light bg-dark">Independent, community-driven cyber threat intelligence.</span></p> 227 <p><a class="btn btn-primary btn-lg" href="#platforms" role="button">Our platforms »</a></p> 228 </div> 229</div> 230 231<div data-spy="scroll" data-target="#MainNavbar" data-offset="0"> 232 <section id="about"> 233 <div class="container"> 234 <div class="jumbotron jumbotron-fluid jumbotron-white mb-0 pb-0"> 235 <h2 class="wh mt-4 mb-3"><span class="bg-dark">OUR MISSION</span></h2> 236 <p>Making the Internet a safer place by providing actionable, community-driven threat intelligence data.</p> 237 <p>abuse.ch has been effecting change on cybercrime for almost twenty years, owing to global recognition of our identified and tracked cyber threat signals. Supported by a community of 15,000 specialist researchers, abuse.châs independent intelligence is relied on by security researchers, network operators and law enforcement agencies.</p> 238 <p>Together with <a href="https://spamhaus.com/" target="_parent" title="Spamhaus Technology" rel="noopener">Spamhaus</a>, we provide the largest, independently crowdsourced intelligence of tracked malware and botnets to the industry. We develop and operate specialized platforms, built for IT security experts, to share and access relevant threat intel data.</p> 239 <p>abuse.ch is an established, trusted, and dedicated space for cyber threat intelligence experts.</p> 240 <p>Community is Central; Sharing is Caring.</p> 241 <p>Follow us on social media:</p> 242 <div class="d-flex justify-content-between mt-4 about-socials"> 243 <div class="d-flex align-items-center" style="gap: 1rem"> 244 <img src="/images/x.svg" alt="X logo" height="32"> 245 <a href="https://x.com/abuse_ch">@abuse_ch</a> 246 </div> 247 <div class="d-flex align-items-center" style="gap: 1rem"> 248 <img src="/images/linkedin.svg" alt="LinkedIn logo" height="32"> 249 <a href="https://linkedin.com/company/abuse-ch/">abuse.ch</a> 250 </div> 251 <div class="d-flex align-items-center" style="gap: 1rem"> 252 <img src="/images/mastodon.svg" alt="Mastodon logo" height="28"> 253 <a href="https://ioc.exchange/@abuse_ch">@[email protected]</a> 254 </div> 255 <div class="d-flex align-items-center" style="gap: 1rem"> 256 <img src="/images/bluesky.svg" alt="Bluesky logo" height="32"> 257 <a href="https://bsky.app/profile/abuse-ch.bsky.social">@abuse-ch.bsky.social</a> 258 </div> 259 </div> 260 </div> 261 262 </section> 263 264 <section id="platforms"> 265 <div class="container"> 266 <div class="jumbotron jumbotron-fluid jumbotron-white mb-0 pb-0"> 267 <h2 class="wh mt-4 mb-3"><span class="bg-dark">OUR PLATFORMS</span></h2> 268 <p>abuse.ch maintains six public platforms, all supported by our partnership with Spamhaus, to aid cybersecurity researchers and practitioners in their day-to-day roles. Varying in focus areas, all platforms are designed to help identify, track, and mitigate against malware and botnet-related cyber threats.</p> 269 <p>The abuse.ch community, anti-virus vendors and threat intelligence providers can contribute and consume from the following platforms:</p> 270 <div class="row"> 271 <div class="col-sm-12"> 272 <a href="https://hunting.abuse.ch/" target="_blank" title="Hunting"> 273 <picture> 274 <source width="100%" height="100%" class="img-responsive img-fluid img-colorify" srcset="images/hunting.webp" type="image/webp"> 275 <source width="100%" height="100%" class="img-responsive img-fluid img-colorify" srcset="images/hunting.png" type="image/png"> 276 <img width="100%" height="100%" class="img-responsive img-fluid img-colorify" src="images/hunting.png" alt="Malw
276areBazaar"> 277 </picture> 278 </a> 279 <p class="text-left">Hunt across all abuse.ch platforms with one simple query - discover if an IPv4 address, domain, URL or file hash has been identified on any platform from a centralized search tool</p> 280 </div> 281 </div> 282 <div class="row"> 283 <div class="col-sm-4"> 284 <a href="https://bazaar.abuse.ch/" target="_blank" title="MalwareBazaar"> 285 <picture> 286 <source width="100%" height="100%" class="img-responsive img-fluid img-colorify" srcset="images/bazaar.webp" type="image/webp"> 287 <source width="100%" height="100%" class="img-responsive img-fluid img-colorify" srcset="images/bazaar.png" type="image/png"> 288 <img width="100%" height="100%" class="img-responsive img-fluid img-colorify" src="images/bazaar.png" alt="MalwareBazaar"> 289 </picture> 290 </a> 291 <p class="text-left">Sharing newly observed malware samples</p> 292 </div> 293 <div class="col-sm-4"> 294 <a href="https://feodotracker.abuse.ch/" target="_blank" title="Feodo Tracker"> 295 <picture> 296 <source width="100%" height="100%" class="img-responsive img-fluid img-colorify" srcset="images/feodo.webp" type="image/webp"> 297 <source width="100%" height="100%" class="img-responsive img-fluid img-colorify" srcset="images/feodo.png" type="image/png"> 298 <img width="100%" height="100%" class="img-responsive img-fluid img-colorify" src="images/feodo.png" alt="Feodo Tracker"> 299 </picture> 300 </a> 301 <p class="text-left">Used to track servers of prolific C2s - since Operation Endgame, this dataset is empty</p> 302 </div> 303 <div class="col-sm-4"> 304 <a href="https://sslbl.abuse.ch/" target="_blank" title="SSL Blacklist (SSLBL)"> 305 <picture> 306 <source width="100%" height="100%" class="img-responsive img-fluid img-colorify" srcset="images/ssl.webp" type="image/webp"> 307 <source width="100%" height="100%" class="img-responsive img-fluid img-colorify" srcset="images/ssl.png" type="image/png"> 308 <img width="100%" height="100%" class="img-responsive img-fluid img-colorify" src="images/ssl.png" alt="SSL Blacklist (SSLBL)"> 309 </picture> 310 </a> 311 <p class="text-left">Sharing blocklist data for malicious SSL certificates and JA3/JA3s fingerprints</p> 312 </div> 313 </div> 314 <div class="row"> 315 <div class="col-sm-4"> 316 <a href="https://urlhaus.abuse.ch/" target="_blank" title="URLhaus"> 317 <picture> 318 <source width="100%" height="100%" class="img-responsive img-fluid img-colorify" srcset="images/urlhaus.webp" type="image/webp"> 319 <source width="100%" height="100%" class="img-responsive img-fluid img-colorify" srcset="images/urlhaus.png" type="image/png"> 320 <img width="100%" height="100%" class="img-responsive img-fluid img-colorify" src="images/urlhaus.png" alt="URLhaus"> 321 </picture> 322 </a> 323 <p class="text-left">Sharing malicious URLs being used for malware distribution</p> 324 </div> 325 <div class="col-sm-4"> 326 <a href="https://threatfox.abuse.ch/" target="_blank" title="ThreatFox"> 327 <picture> 328 <source width="100%" height="100%" class="img-responsive img-fluid img-colorify" srcset="images/threatfox.webp" type="image/webp"> 329 <source width="100%" height="100%" class="img-responsive img-fluid img-colorify" srcset="images/threatfox.png" type="image/png"> 330 <img width="100%" height="100%" class="img-responsive img-fluid img-colorify" src="images/threatfox.png" alt="ThreatFox"> 331 </picture> 332 </a> 333 <p class="text-left">
333Sharing indicators of compromise (IOCs) associated with malware.</p> 334 </div> 335 <div class="col-sm-4"> 336 <a href="https://yaraify.abuse.ch/" target="_blank" title="YARAify"> 337 <picture> 338 <source width="100%" height="100%" class="img-responsive img-fluid img-colorify" srcset="images/yaraify.webp" type="image/webp"> 339 <source width="100%" height="100%" class="img-responsive img-fluid img-colorify" srcset="images/yaraify.png" type="image/png"> 340 <img width="100%" height="100%" class="img-responsive img-fluid img-colorify" src="images/yaraify.png" alt="YARAify"> 341 </picture> 342 </a> 343 <p class="text-left">A large repository of YARA rules to identify and classify malware - use to share rules, hunt, and scan</p> 344 </div> 345 </div> 346 </div> 347 </div> 348 </section> 349 350 351 <section id="community"> 352 <div class="container mb-5"> 353 <div class="jumbotron jumbotron-fluid jumbotron-white mb-0 pb-0"> 354 <h2 class="wh mt-4 mb-3"><span class="bg-dark">OUR COMMUNITY</span></h2> 355 <p>Our platforms rely on the time and expertise of volunteers who choose to share their findings with the community. This crowd-sourced intelligence powers our platforms and drives their real-world impact. In return, earn recognition for the malware intelligence you contribute, climb the leaderboards, and connect with like-minded hunters.</p> 356 <p>Join the growing Community and see the difference you're making, both individually and and alongside fellow contributors.</p> 357 <a class="btn btn-dark btn-xs mb-3" href="https://community.abuse.ch" target="_parent" role="button" title="abuse.ch Community Hub">Community Hub ></a> 358 </div> 359 360 </section> 361 362 <section id="blog"> 363 <div class="jumbotron jumbotron-fluid jumbotron-blue mt-4"> 364 <div class="container"> 365 <h2 class="wh mt-4 mb-3"><span class="bg-dark">BLOG</span></h2> 366
367 <h3 class="mt-5 blogarchivewhite"><a href="/blog/introducing-abuse-ch-community-hub/" target="_parent" class="text-white">Introducing the abuse.ch Community Hub: recognition matters</a></h3> 368 <p style="color: #A6ACAF">Published on 28th July 2026, 11:00:00 UTC</p> 369 <p style="color:#ffffff;">For years, the abuse.ch community has been quietly doing some of the most important work on the internet. Researchers and analysts around the world share malicious threat intelligence all with one mission: to make the internet safer for everyone. Today, we're giving that community the recognition it deserves, with a dedicated space to celebrate your efforts and track your impact.</p> 370 <a class="btn btn-light btn-xs mb-3" href="/blog/introducing-abuse-ch-community-hub/" target="_parent" role="button" title="Read the full blog post">Read on ></a> 371 372 <h3 class="mt-5 blogarchivewhite"><a href="/blog/creating-sustainability-for-abuse-ch-and-its-community/" target="_parent" class="text-white">Creating sustainability for abuse.ch and its community</a></h3> 373 <p style="color: #A6ACAF">Published on 29th July 2025, 13:30:00 UTC</p> 374 <p style="color:#ffffff;">The saying "there is nothing so constant as change" rings true, yet embracing change can be challenging. We humans are creatures of habit, and shifts in established, trusted systems can understandably lead to unease. We recognize that abuse.ch is currently undergoing significant changes, and while we've been communicating some of these since 2022, the strengthened alliance between abuse.ch and Spamhaus is now becoming more apparent.</p> 375 <a class="btn btn-light btn-xs mb-3" href="/blog/creating-sustainability-for-abuse-ch-and-its-community/" target="_parent" role="button" title="Read the full blog post">Read on ></a> 376
377 <h3 class="mt-5 blogarchivewhite"><a href="/blog/introducing-abuse-ch-hunting-platform/" target="_parent" class="text-white">Introducing: abuse.châs Hunting Platform</a></h3> 378 <p style="color: #A6ACAF">Published on 11th March 2025, 14:11:35 UTC</p> 379 <p style="color:#ffffff;">Community lies at the heart of everything we do. For over 15 years, we have provided actionable cyber threat intelligence through community-driven platforms - completely free of charge. Weâre truly committed to putting the community first. Over time, the number of platforms we operate has grown, to seven distinct platforms, each providing unique benefits in the fight against cyber threats. However, the challenge of searching through each platform for comprehensive threat information has always remained. But that's about to change...</p> 380 <a class="btn btn-light btn-xs mb-3" href="/blog/introducing-abuse-ch-hunting-platform/" target="_parent" role="button" title="Read the full blog post">Read on ></a> 381 382 <h3 class="mt-5 blogar
382chivewhite"><a href="/blog/community-first/" target="_parent" class="text-white">Community First - new authentication, new data, and new functionality</a></h3> 383 <p style="color: #A6ACAF">Published on 18th Nov 2024, 17:00:00 UTC</p> 384 <p style="color:#ffffff;">abuse.ch has an unwavering commitment: to sustain and support its cyber security community. All internet users owe thanks to this force of threat hunters who consistently make a positive and lasting impacton Internet safety. To further empower this collective, with assistance from Spamhaus, developments are coming to all the abuse.ch platforms. Discover what and why in this blog post.</p> 385 <a class="btn btn-light btn-xs mb-3" href="/blog/community-first/" target="_parent" role="button" title="Read the full blog post">Read on ></a> 386 387 <h3 class="mt-5 blogarchivewhite"><a href="/blog/ach-stec-the-impact-of-your-contributions/" target="_parent" class="text-white">abuse.ch & Spamhaus: The Impact of Your Contributions</a></h3> 388 <p style="color: #A6ACAF">Published on 11th Nov 2024, 14:00:00 UTC</p> 389 <p style="color:#ffffff;">If youâre contributing to any of the abuse.ch platforms, have you ever wondered about the impact that youâre making? We strongly believe that âsharing is caringâ and so are shedding more light on how your contributions are making the internet a safer place - for everyone! Your contributions have more impact than you think.</p> 390 <a class="btn btn-light btn-xs mb-3" href="/blog/ach-stec-the-impact-of-your-contributions/" target="_parent" role="button" title="Read the full blog post">Read on ></a> 391
392 <h3 class="mt-5 blogarchivewhite"><a href="/blog/abuse-ch-appoints-spamhaus-as-a-licensee/" target="_parent" class="text-white">abuse.ch appoints Spamhaus as a licensee to secure its future</a></h3> 393 <p style="color: #A6ACAF">Published on 8th Aug 2022, 13:00:00 UTC</p> 394 <p style="color:#ffffff;">On Monday, August 1st, 2022, Spamhaus Technology became the primary licensee of data produced by abuse.ch. Here's an outline of why this partnership was conceived and what it hopes to achieve in the future. In 2008, a sole researcher founded abuse.ch â a project committed to fighting abuse on the internet.</p> 395 <a class="btn btn-light btn-xs mb-3" href="/blog/abuse-ch-appoints-spamhaus-as-a-licensee/" target="_parent" role="button" title="Read the full blog post">Read on ></a> 396 397 <h3 class="mt-5 blogarchivewhite"><a href="/blog/introducing-yaraify/" target="_parent" class="text-white">Introducing YARAify</a></h3> 398 <p style="color: #A6ACAF">Published on 13th June 2022, 11:23:48 UTC</p> 399 <p style="color:#ffffff;">About a year ago, we have launched ThreatFox - a community driven platform to share indicators of compromise (IOCs). Today, I'm very excited to announce the launch of our most recent project: <a href="https://yaraify.abuse.ch/" target="_parent" title="YARAify">YARAify</a>! YARAify is your central hub for scanning and hunting files using YARA.</p> 400 <a class="btn btn-light btn-xs mb-3" href="/blog/introducing-yaraify/" target="_parent" role="button" title="Read the full blog post">Read on ></a> 401 402 <br /> 403 <br /> 404 <p class="blogarchivewhite mt-4"><a href="/blog/" target="_parent" title="Blog">Blog Archive</a></p> 405 </div> 406 </div> 407 </section> 408 409 <section id="statistics"> 410 <div class="jumbotron jumbotron-fluid" style="background-color:#ffffff"> 411 <div class="container"> 412 <h2 class="wh mt-4 mb-3"><span class="bg-dark">STATISTICS</span></h2> 413 <p>Using data from our various threat intelligence platforms, below you will find high-level numbers relating to malware signals shared with abuse.ch. This data is updated every 24 hours.</p> 414 <div class="row pt-0 pb-4"> 415 <div class="col-sm-6"> 416 <h3 class="statistic">Most seen Malware</h3> 417 <table class="table table-striped table-hover table-sm center"><thead><tr> 418<th>#</th> <th>Malware</th> 419</tr> 420</thead> 421<tbody><tr> 422<th scope="row">1</th> 423<td>Expiro</td></tr> 424<tr> 425<th scope="row">2</th> 426<td>Koceg</td></tr> 427<tr> 428<th scope="row">3</th> 429<td>Downloader.Upatre</td></tr> 430<tr> 431<th scope="row">4</th> 432<td>Lunam</td></tr> 433<tr> 434<th scope="row">5</th> 435<td>Snojan</td></tr> 436<tr> 437<th scope="row">6</th> 438<td>Blackmoon</td></tr> 439<tr> 440<th scope="row">7</th> 441<td>Gh0stRAT</td></tr> 442<tr> 443<th scope="row">8</th> 444<td>AsyncRAT</td></tr> 445<tr> 446<th scope="row">9</th> 447<td>Floxif</td></tr> 448<tr> 449<th scope="row">10</th> 450<td>Simda</td></tr> 451</tbody> 452</table> 453 454 </div> 455 <div class="col-sm-6"> 456 <h3 class="statistic">Analysed File Types</h3> 457 <table class="table table-striped table-hover table-sm center"><thead><tr> 458<th>Malware Samples</th> <th>File Type</th> 459</tr> 460</thead> 461<tbody><tr> 462<td>8759</td> 463<td>exe</td></tr> 464<tr> 465<td>375</td> 466<td>dll</td></tr> 467<tr> 468<td>283</td> 469<td>rtf</td></tr> 470<tr> 471<td>241</td> 472<td>xls</td></tr> 473<tr> 474<td>203</td> 475<td>jar</td></tr> 476<tr> 477<td>154</td> 478<td>xlsm</td></tr> 479<tr> 480<td>94</td> 481<td>doc</td></tr> 482<tr> 483<td>69</td> 484<td>js</td></tr> 485<tr> 486<td>66</td> 487<td>xlsx</td></tr> 488<tr> 489<td>35</td> 490<td>ps1</td></tr> 491</tbody> 492</table> 493 494 </div> 495 </div> 496 497<br /> 498 <h3 class="statistic">Processed Malware Samples per Day</h3> 499 <div id="sandnet_samples" class="chart"></div> 500 501 <h3 class="statistic">Spam Statistics</h3> 502 <div id="spam_stats" class="chart"></div> 503 </div> 504 </div> 505 </section> 506 507 <!-- Footer --> 508 <footer class="footer"> 509 <div class="content-container"> 510 <div class="d-block d-md-flex align-items-center"> 511 <div class="d-flex gap-4 social-links"> 512 <a href="https://x.com/abuse_ch" rel="noopener" target="_blank"> 513 <svg 514 height="24" 515 width="24" 516 fill="white" 517 xmlns="http://www.w3.org/2000/svg"
518 viewBox="0 0 512 512" 519 > 520 <path 521 d="M389.2 48h70.6L305.6 224.2 487 464H345L233.7 318.6 106.5 464H35.8L200.7 275.5 26.8 48H172.4L272.9 180.9 389.2 48zM364.4 421.8h39.1L151.1 88h-42L364.4 421.8z" 522 /> 523 </svg> 524 </a> 525 <a 526 href="https://www.linkedin.com/company/abuse-ch/" 527 rel="noopener" 528 target="_blank" 529 > 530 <svg 531 height="24" 532 width="24" 533 fill="white" 534 xmlns="http://www.w3.org/2000/svg" 535 viewBox="0 0 448 512" 536 > 537 <path 538 d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3zM135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5zm282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9V416z" 539 /> 540 </svg> 541 </a> 542 <a href="https://ioc.exchange/@abuse_ch" rel="noopener" target="_blank"> 543 <svg 544 height="24" 545 width="24" 546 fill="white" 547 xmlns="http://www.w3.org/2000/svg"
548 viewBox="0 0 448 512" 549 > 550 <path 551 d="M433 179.1c0-97.2-63.7-125.7-63.7-125.7-62.5-28.7-228.6-28.4-290.5 0 0 0-63.7 28.5-63.7 125.7 0 115.7-6.6 259.4 105.6 289.1 40.5 10.7 75.3 13 103.3 11.4 50.8-2.8 79.3-18.1 79.3-18.1l-1.7-36.9s-36.3 11.4-77.1 10.1c-40.4-1.4-83-4.4-89.6-54a102.5 102.5 0 0 1 -.9-13.9c85.6 20.9 158.7 9.1 178.8 6.7 56.1-6.7 105-41.3 111.2-72.9 9.8-49.8 9-121.5 9-121.5zm-75.1 125.2h-46.6v-114.2c0-49.7-64-51.6-64 6.9v62.5h-46.3V197c0-58.5-64-56.6-64-6.9v114.2H90.2c0-122.1-5.2-147.9 18.4-175 25.9-28.9 79.8-30.8 103.8 6.1l11.6 19.5 11.6-19.5c24.1-37.1 78.1-34.8 103.8-6.1 23.7 27.3 18.4 53 18.4 175z" 552 /> 553 </svg> 554 </a> 555 <a 556 href="https://bsky.app/profile/abuse-ch.bsky.social" 557 rel="noopener" 558 target="_blank" 559 > 560 <svg 561 height="24" 562 width="24" 563 fill="white" 564 xmlns="http://www.w3.org/2000/svg"
565 viewBox="0 0 512 512" 566 > 567 <path 568 d="M111.8 62.2C170.2 105.9 233 194.7 256 242.4c23-47.6 85.8-136.4 144.2-180.2c42.1-31.6 110.3-56 110.3 21.8c0 15.5-8.9 130.5-14.1 149.2C478.2 298 412 314.6 353.1 304.5c102.9 17.5 129.1 75.5 72.5 133.5c-107.4 110.2-154.3-27.6-166.3-62.9l0 0c-1.7-4.9-2.6-7.8-3.3-7.8s-1.6 3-3.3 7.8l0 0c-12 35.3-59 173.1-166.3 62.9c-56.5-58-30.4-116 72.5-133.5C100 314.6 33.8 298 15.7 233.1C10.4 214.4 1.5 99.4 1.5 83.9c0-77.8 68.2-53.4 110.3-21.8z" 569 /> 570 </svg> 571 </a> 572 </div> 573 <div class="footer-policies md:flex-row col"> 574 <a href="https://abuse.ch/terms-and-conditions/" class="nav-link-w">Terms and Conditions</a> 575 <span class="d-md-block d-none">|</span> 576 <a href="https://abuse.ch/terms-of-use/" class="nav-link-w">Terms of Use</a> 577 <span class="d-md-block d-none">|</span> 578 <a href="https://abuse.ch/privacy-policy/" class="nav-link-w">Privacy Policy</a> 579 <span class="d-md-block d-none">|</span> 580 <a href="https://abuse.ch/cookie-policy/" class="nav-link-w">Cookie Policy</a> 581 </div> 582 </div> 583 </div> 584 </footer> 585</body> 586</html>
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.