NEW | Hunt across all abuse.ch platforms with one simple query - discover if an IPv4 address, domain, URL or file hash has been identified on any platform from a centralized search tool. Test it out here hunting.abuse.ch - and happy hunting 🔍

Statistics

ThreatFox produces detailed statistics on indicators of compromise shared - find the available statistics below.

You can also access Spamhaus's Malware Digest report, based on ThreatFox data:

The statistics below consider indicators of compromise (IOCs) submitted to ThreatFox within the past 14 days.

Number of IOCs shared


The chart below documents the number of indicators of compromise (IOCs) shared on ThreatFox per day over a period of 30 days.

Top Contributors


Threatfox is "just" a platform for sharing IOCs. It would be worthless without the help of volunteers who contribute their IOCs to the project. The table below shows the top contributors by credits earned for the past 30 days.

RankReporterLast activitySubmissions
1 TheRavenFile2025-04-03 07:26:1722'438
2 juroots2025-04-02 13:24:472'319
3 DonPasci2025-04-03 04:01:311'613
4 abuse_ch2025-04-03 07:35:29741
5 Gi7w0rm2025-03-28 16:01:19581
6 s1dhy2025-03-31 06:14:02570
7 RacWatchin88722025-04-03 06:11:44416
8 dyingbreeds_2025-04-03 06:10:59298
9 threatcat_ch2025-04-03 07:15:34195
10 DaveLikesMalwre2025-04-01 05:27:23184

Top Malware Families

Top Tags

IOCs by type


IOCs on ThreatFox are categorized so called IOC types. The following table shows the number of IOCs observed on ThreatFox per IOC type (past 14 days).

IOCsIOC TypeIOC description
22'474sha256_hashSHA256 hash of a malware sample (payload)
2'959ip:portip:port combination that is used for botnet Command&control (C&C)
2'199domainDomain that is used for botnet Command&control (C&C)
1'285urlURL that is used for botnet Command&control (C&C)
868domainDomain name that delivers a malware payload
364urlURL that delivers a malware payload
29md5_hashMD5 hash of a malware sample (payload)
15domainDomain used for credit card skimming (usually related to Magecart attacks)
7ip:portip:port combination that delivery a malware payload
3sha1_hashSHA1 hash of a malware sample (payload)

The statistics below consider indicators of compromise (IOCs) submitted to ThreatFox since it's launch in March 2021.

Number of IOCs shared


The chart below documents the number of indicators of compromise (IOCs) shared on ThreatFox per day over a period of 12 months.

Top Contributors


Threatfox is "just" a platform for sharing IOCs. It would be worthless without the help of volunteers who contribute their IOCs to the project. The table below shows the top contributors by credits earned.

RankReporterLast activitySubmissions
1 Cryptolaemus12025-03-18679'883
2 abuse_ch2025-04-03138'235
3 drb_ra2025-01-2388'255
4 Gi7w0rm2025-03-2950'269
5 TheRavenFile2025-04-0333'187
6 DonPasci2025-04-0326'701
7 lazyactivist1922025-02-0729'739
8 Grim2024-11-1329'552
9 Virus_Deck2022-09-3029'150
10 thehappydinoa2024-12-0223'615

Top Malware Families

Top Tags

IOCs by type


IOCs on ThreatFox are categorized so called IOC types. The following table shows the number of IOCs observed on ThreatFox per IOC type (overall).

IOCsIOC TypeIOC description
756'415sha256_hashSHA256 hash of a malware sample (payload)
184'422ip:portip:port combination that is used for botnet Command&control (C&C)
183'089urlURL that delivers a malware payload
96'306domainDomain that is used for botnet Command&control (C&C)
94'248urlURL that is used for botnet Command&control (C&C)
31'018domainDomain name that delivers a malware payload
13'631md5_hashMD5 hash of a malware sample (payload)
10'323sha1_hashSHA1 hash of a malware sample (payload)
2'991ip:portip:port combination that delivery a malware payload
465domainDomain used for credit card skimming (usually related to Magecart attacks)
21sha3_384_hashSHA3-384 hash of a malware sample (payload)
1envelope_fromSender email address (envelope from) that is used for payload delivery