Because malware sucks

abuse.ch is operated by a random swiss guy fighting malware for non-profit,
running a couple of projects helping internet service providers and network operators protecting
their infrastructure from malware. IT-Security researchers, vendors and law enforcement agencies rely
on data from abuse.ch, trying to make the internet a safer place.

> Blog


Moving Forward

Published on 26th October 2020, 13:45:09 UTC

13 years ago, I started to look at malware samples in my spare time that occasionally hit my personal mailbox. I've decided to document my findings in a blog, and abuse.ch was born. In the same year, ZeuS (aka Zbot) appeared. Sold on the dark web, it quickly became one of the most popular crimeware kits for cyber criminals to commit ebanking fraud and identity theft. Due to the rise of ZeuS in 2008/2009, I decided to create my first project: ZeuS Tracker. The two ... [read on]


Introducing MalwareBazaar

Published on 17th March 2020, 12:29:31 UTC

Almost two years ago, I've launched URLhaus with the goal of collecting malware distribution sites. With more than 300,000 malware distribution sites tracked, the project still is a great success. However, over the past weeks, I've been focusing my efforts on a new project. And here' it is: MalwareBazaar! MalwareBazaar collects known malicious malware sample, enriches them with additional intelligence and provides them back to the community - for free! [read on]


Using URLhaus as a Response Policy Zone (RPZ)

Published on 14th June 2019, 09:46:12 UTC

A few days ago, URLhaus, cracked 200,000 malware URLs tracked. The majority of the malware sites tracked by URLhaus are related to Emotet (aka Heodo), followed by Mirai, Gayfgyt and Gozi ISFB (aka Ursnif). But there are many other threats being tracked with the help of the infosec community. There are several ways how to utilize the data generated by the community to protect your network and users. This blog post is a short tutorial on how to use URLhaus as a DNS Response Policy Zone (RPZ). What is RPZ? RPZ is a way to rewrite or block responses to DNS queries. It is sometimes also refered as DNS Firewall, as it allows system administrators to block access to certain domain names. [read on]


How to Takedown 100,000 Malware Sites

Published on 21th January 2019, 11:23:48 UTC

End of March 2018, abuse.ch launched it's most recent project called URLhaus. The goal of URLhaus is to collect and share URLs that are being used for distributing malware. The project is a huge success: with the help of the community, URLhaus was able to takedown almost 100,000 malware distribution sites within just 10 months! During that time, 265 security researchers located all over the world have identified and submitted in average 300 malware sites to URLhaus each day, helping others to protect their network and users from malware campaigns. [read on]


Measuring Reaction Time of Abuse Desks

Published on 1st October 2018, 11:23:48 UTC

In March 2018, I've launched my most recent project called URLhaus. The goal of URLhaus is to collect and share URLs that are being used for distributing malware. In the first half year, 234 users have contributed and shared more than 50'000 malware distribution sites on URLhaus. That's amazing! But URLhaus does not only collect malware URLs: The project also reports active malware distribution sites to blacklist providers like Spamhaus, SURBL and Google Safe Browsing.Since June 2018, URLhaus is also sending out automated abuse reports to the respective network owners by using Abuseix Abuse Contact DB. [read on]


Sinkholes and Internet Hygiene

Published on 13th September 2018, 12:52:49 UTC

Keeping the Internet hygiene good can be challenging. There is a lot of badness around, harming not only internet users, organisations or corporate networks but also services that rely on the internet and sometimes even the integrity and stability of the internet itself. It is therefore essential to keep a certain level of internet hygiene. Among other things, internet services providers (ISPs) and national computer emergency response teams (CERTs) try to achieve that by collecting information about infected computers (so-called "bots") in order to notify the associated broadband subscriber or network owner about compromised machines. [read on]



Blog Archive

> Statistics

Most seen Malware

# Malware
1 Quakbot
2 Worm.Vobfus
3 AgentTesla
4 AveMariaRAT
5 njrat
6 Drolnux
7 CoinMiner
8 Worm.Ramnit
9 Expiro
10 Heodo

Analysed File Types

Malware Samples File Type
9490 exe
6508 xlsb
868 dll
443 xls
248 docx
151 xlsx
150 xlsm
83 doc
73 jar
27 vbs

Processed Malware Samples per Day

Spam Statistics

> Partners

Running abuse.ch and its project wouldn't be possible without the good will and support from 3rd parties.
Some of them decided to remain anonymous and hence do not wish to get named in public.