Data is collected directly from researchers hunting active malware, botnets, and C2 servers, ensuring high relevance and operational value for defenders.
Solutions
Data
Email & Network
Cyber Threat Intelligence
Resources
About
Malware
Intelligence
High-impact data, dedicated to malware indicators, from a globally diverse, knowledge-rich community. Offering timely, high-quality indicators to detect and block malicious infrastructure before it impacts your network or users.
High-Fidelity
Malware Intel
Community intelligence brings the power of many: the identification and confirmation of patterns, clusters, and anomalies is far more effective than any single analyst.
We offer binary data to protect using your MX, firewalls or network edge infrastructure, and valuable context through tracked, enriched IOCs to better understand internal events such as web proxy logs, DNS queries, email traffic, or firewall events.
From active botnet controllers, to specific URLs and files, to hunting and tracking with historic data - access malware intel that’s affordable, without flashy, surplus features and capabilities. Act proportionally, efficiently, and avoid incorrect remediation actions.
Real-World Threat Sources
Timely Intelligence Updates
Indicators are updated in real-time, allowing rapid detection and blocking of newly emerging threats before they spread widely.
Focused on Malicious Infrastructure
Targets infrastructure actively used for malware distribution, command-and-control, phishing, and other cybercrime operations.
Datasets
Datasets with Malware Intel Coverage
Our datasets are defined by policy. The policies are created with alignment and input from the wider industry. This is to avoid bias, and ensure sound rationale behind every detection made. Our datasets are grouped by area of concern - for example, highly malicious networks, active botnet c2s, malware URLs. All datasets shown here have coverage of Malware-related activity, with binary and contextual data available, though may not cover malware indicators exclusively.
Botnet C2 IPs
Binary Data
Contextual Data
Botnet command and controller (C2) servers. The status of these single IPv4 addresses is re-evaluated several times a day to identify active botnet controllers only. Utilize for protection or threat intelligence requirements.
Compromised IPs
Binary Data
Contextual Data
IP addresses exhibiting signs of compromise, which can include downloaded malware, security vulnerabilities allowing unauthorized access, etc. Designed to protect networks from malware and spam by preventing connections from these IPs. Available in binary and contextual format.
Domain Intel
Contextual Data
Contextual metadata on every domain observed and analyzed by our researchers. This includes reputation areas to strengthen, domain contexts, senders data, nameserver reputation, A Record reputation, correlated related domains, listed Hostnames, and malware.
Access Methods
Low Reputation Domains
Binary Data
Contextual Data
Domains and hosts used for suspicious or malicious activity, e.g., those associated with phishing, spam, malware, botnet command and controllers (C2s), and redirector domains; may be owned by malicious actors or have been hijacked. Available in binary and contextual formats.
Access Methods
Low Reputation Resources
Binary Data
Malicious internet resources, including cryptowallets, malware files, email addresses, and URLs (including shorteners, redirectors, and online file storage providers). Provided as cryptographic hashes and described by users as "a game-changer".
Access Methods
Malicious file telemetry
Contextual Data
A non-public platform that executes malware samples in a controlled environment to collect the associated signals and metadata - before and during the execution. This data is only available via the Real Time Intelligence Feed.
Access Methods
Malicious network ranges
Binary Data
This dataset exposes IPs being observed in a range of adversarial activities, derived through Open Source Intelligence (OSINT) from Spamhaus' most specialized and experienced researchers.
Access Methods
Malware IoCs
Contextual Data
Retrieve IP addresses, domains, URLs, and file hashes linked to malware activities. Gain crucial context with confidence levels, first/last seen timestamps, threat type , reporter, and sightings - indicating trustworthiness, relevance over time, nature of the threat, source legitimacy, and frequency of observation.
Access Methods
Malware Samples
Contextual Data
A vast, continuously updated collection of malicious files enriched with metadata, offering a high-fidelity view of the evolving threat landscape for security analysis and research needs. Samples available to download.
Access Methods
Malware URLs
Contextual Data
Tracked URLs that are being used for malware distribution. Access real-time contextual details, including associated payloads, tags, malware families, and whether the URL status is offline or online, to hunt with and better understand adversarial TTPs.
Access Methods
YARA Scan Results
Contextual Data
Metadata based on millions of suspicious malware sample scans. Enhance your retroactive or active hunting capabilities by matching known malware patterns, automating malware classification, and improving detection accuracy with this large, community-driven signal repository.
Access Methods
Related Solutions
Threat Hunting
Improve detection fidelity with data solely concentrated on malware-focused intrusions to drive hunting hypotheses, understand trends and correlations, and prioritize investigation paths.
Threat Intelligence Enrichment
Increase detection rates and enrich alerting context with malware signals that will help you uncover and address attack behaviour faster.
DNS Protection
Automatically block malicious activity at the DNS level, utilizing Response Policy Zones (RPZs) to safeguard your network and users against a variety of online threats.
Discover more
See all resources
Need Help?
Get in touch
Spamhaus is committed to protecting and respecting your privacy. We’ll only use your personal information to respond to your enquiry, manage any accounts you may set-up, and to provide the products and services you request from us. From time to time, we would like to contact you about our products and services, as well as other security related content that may be of interest to you. If you consent to us contacting you for this purpose, please tick the box below.
You can unsubscribe from these communications at any time. For more information on how to unsubscribe, our privacy practices, and how we are committed to protecting and respecting your privacy, please review our Privacy Policy.
By clicking submit below, you consent to allow Spamhaus to store and process the personal information submitted above to provide you the content requested.
I agree to receive other communications from Spamhaus.