Statistics

The statistics below consider indicators of compromise (IOCs) submitted to ThreatFox within the past 14 days.

Number of IOCs shared

---

The chart below documents the number of indicators of compromise (IOCs) shared on ThreatFox per day over a period of 30 days.

Top Contributors

---

Threatfox is "just" a platform for sharing IOCs. It would be worthless without the help of volunteers who contribute their IOCs to the project. The table below shows the top contributors by credits earned for the past 30 days.

Rank	Reporter	Last activity	Credits earned	Submissions
1	@Cryptolaemus1	2023-05-26	4'268'775	674'003
2	@abuse_ch	2023-05-29	599'520	90'988
3	@drb_ra	2023-05-29	490'280	58'010
4	@nickkuechel	2023-05-29	97'635	15'932
5	@pr0xylife	2023-05-24	36'050	6'147
6	@crep1x	2023-05-25	23'055	4'576
7	@0xrb	2023-05-16	19'350	2'900
8	@Rony	2023-05-29	17'520	3'329
9	@Gi7w0rm	2023-05-26	15'365	3'063
10	@myonium1	2023-05-23	7'045	1'404

IOCs by type

---

IOCs on ThreatFox are categorized so called IOC types. The following table shows the number of IOCs observed on ThreatFox per IOC type (past 14 days).

IOCs	IOC Type	IOC description
2'999	url	URL that delivers a malware payload
1'893	ip:port	ip:port combination that is used for botnet Command&control (C&C)
1'157	url	URL that is used for botnet Command&control (C&C)
384	domain	Domain that is used for botnet Command&control (C&C)
118	sha256_hash	SHA256 hash of a malware sample (payload)
34	md5_hash	MD5 hash of a malware sample (payload)
11	domain	Domain name that delivers a malware payload
4	sha1_hash	SHA1 hash of a malware sample (payload)
3	ip:port	ip:port combination that delivery a malware payload
2	domain	Domain used for credit card skimming (usually related to Magecart attacks)