Statistics

ThreatFox produces detailed statistics on indicators of compromise shared - find the available statistics below.

You can also access Spamhaus's Malware Digest report, based on ThreatFox data:

The statistics below consider indicators of compromise (IOCs) submitted to ThreatFox within the past 14 days.

Number of IOCs shared

The chart below documents the number of indicators of compromise (IOCs) shared on ThreatFox per day over a period of 30 days.

Top Contributors

Threatfox is "just" a platform for sharing IOCs. It would be worthless without the help of volunteers who contribute their IOCs to the project. The table below shows the top contributors by credits earned for the past 30 days.

RankReporterLast activityCredits earnedSubmissions
1Twitter @abuse_ch2025-01-20 776'725119'773
2Twitter @Gi7w0rm2025-01-20 228'42043'746
3Twitter @DonPasci2025-01-20 124'17018'577
4Twitter @NDA0E2025-01-20 61'21511'200
5Twitter @abus3reports2025-01-16 46'1708'172
6Twitter @crep1x2025-01-20 36'3157'190
7Twitter @Rony2025-01-20 26'4654'612
8Twitter @dyingbreeds_2025-01-20 21'9654'098
9Twitter @500mk5002025-01-19 17'9203'506
10Twitter @myonium12025-01-14 15'2552'957

Top Malware Families

Top Tags

IOCs by type

IOCs on ThreatFox are categorized so called IOC types. The following table shows the number of IOCs observed on ThreatFox per IOC type (past 14 days).

IOCsIOC TypeIOC description
3'884ip:portip:port combination that is used for botnet Command&control (C&C)
1'565domainDomain that is used for botnet Command&control (C&C)
747urlURL that is used for botnet Command&control (C&C)
328urlURL that delivers a malware payload
275domainDomain name that delivers a malware payload
102sha256_hashSHA256 hash of a malware sample (payload)
33ip:portip:port combination that delivery a malware payload
17md5_hashMD5 hash of a malware sample (payload)
6sha1_hashSHA1 hash of a malware sample (payload)
2domainDomain used for credit card skimming (usually related to Magecart attacks)

The statistics below consider indicators of compromise (IOCs) submitted to ThreatFox since it's launch in March 2021.

Number of IOCs shared

The chart below documents the number of indicators of compromise (IOCs) shared on ThreatFox per day over a period of 12 months.

Top Contributors

Threatfox is "just" a platform for sharing IOCs. It would be worthless without the help of volunteers who contribute their IOCs to the project. The table below shows the top contributors by credits earned.

RankReporterLast activityCredits earnedSubmissions
1 Cryptolaemus12024-12-17 4'307'335679'877
2 abuse_ch2025-01-20 776'725119'773
3 drb_ra2024-11-13 694'96588'255
4 Gi7w0rm2025-01-20 228'42043'746
5 lazyactivist1922024-01-17 148'74529'736
6 Grim2024-11-13 148'11029'552
7 Virus_Deck2022-09-30 147'93029'150
8 thehappydinoa2024-12-02 142'18523'615
9 TheTallJohnBrown2024-03-14 129'11525'823
10 DonPasci2025-01-20 124'17018'577

Top Malware Families

Top Tags

IOCs by type

IOCs on ThreatFox are categorized so called IOC types. The following table shows the number of IOCs observed on ThreatFox per IOC type (overall).

IOCsIOC TypeIOC description
724'483sha256_hashSHA256 hash of a malware sample (payload)
181'418urlURL that delivers a malware payload
169'882ip:portip:port combination that is used for botnet Command&control (C&C)
87'685urlURL that is used for botnet Command&control (C&C)
70'036domainDomain that is used for botnet Command&control (C&C)
27'825domainDomain name that delivers a malware payload
13'136md5_hashMD5 hash of a malware sample (payload)
10'297sha1_hashSHA1 hash of a malware sample (payload)
2'608ip:portip:port combination that delivery a malware payload
421domainDomain used for credit card skimming (usually related to Magecart attacks)
21sha3_384_hashSHA3-384 hash of a malware sample (payload)