abuse.ch

abuse.ch operates six public platforms for sharing and accessing malware and botnet threat intelligence. They include a malware sample exchange, a botnet C2 tracker, SSL certificate and JA3 blocklists, a malicious URL feed, an indicator-of-compromise (IOC) sharing service, a YARA rule repository, and a centralized search across all platforms for IPv4 addresses, domains, URLs and file hashes.

The platforms are free of charge and are used by security researchers, network operators, anti-virus vendors, threat intelligence providers and law enforcement agencies. Data is contributed by a volunteer community of 15,000 specialist researchers, and contributors earn recognition through a Community Hub. Since 1 August 2022, Spamhaus Technology has been the primary licensee of abuse.ch data, and the two organisations provide the largest independently crowdsourced intelligence of tracked malware and botnets to the industry together.

The project was founded in 2008 by a sole researcher. It has operated for almost twenty years and has been providing its platforms without charge for more than 15 years.

Product: Six public threat intelligence platforms for sharing malware samples, botnet C2 data, SSL/JA3 blocklists, malicious URLs, IOCs and YARA rules.