๐ข To our incredible community of contributors: thank you for everything you do to keep the internet safe! ๐ก๏ธ
To help protect our platforms and maintain the high-quality data you rely on, here is a quick refresher on our submission guidelines across MalwareBazaar, URLhaus, and ThreatFox: ๐
โ Why do these guidelines matter so much? โ
1๏ธโฃ Impact at scale: Our datasets power security tools worldwide ๐. Inaccurate submissions cause false positives on a massive scale - with great power comes great responsibility! ๐ธ๏ธ๐ช
2๏ธโฃ Actionable intelligence: We want the data to stay razor-sharp and immediately useful, not a graveyard of noise ๐ชฆ
If an contributor's account is ever restricted, our goal is always to send an explanation right away โ๏ธ.
On rare occasions, immediate action is required to prevent harm before we can send a heads-up. If this happens, please reach out to us so we can review it together: ๐ contact.abuse.ch/
Since 2009, abuse.ch has been built by the community, for the community. None of this works without you. ๐
If a policy ever feels unclear or counterproductive, talk to us! We would much rather refine our wording (or the policy itself) than lose good data or a great contributor. ๐
Quick links to the submission policies for each platform:
๐ฆ MalwareBazaar: bazaar.abuse.ch/faq/#policy
๐ URLhaus:
urlhaus.abuse.ch/api/#policy
๐ฆ ThreatFox:
threatfox.abuse.ch/faq/
Thank you for standing with us to make the web safer for everyone! ๐๐
4
4
11
3,169
Did you know that if you run Cowrie high interaction SSH and Telnet honeypot ๐ฏ๐, you can automatically submit malicious URLs caught by it to URLhaus ๐ก? If you aren't running a Cowrie honeypot yet, you may want to check it out:
Project website:
๐ฅ๏ธ cowrie.org/
GitHub repository:
๐ฑ๏ธ github.com/cowrie/cowrie
Malicious URLs caught by Cowrie honeypots:
๐ urlhaus.abuse.ch/browse/tag/โฆ
ALT Cowrie SSH and Telnet honeypot
7
7
1,615
A couple of months in and the Community Hub is thriving ๐คฉ ... 36,441 contributions across all abuse.ch platforms in the last 30 days (up +30.8%) ๐ฅ๐ฅ๐ฅ
@geenensp ๐ฅ on URLhaus (78-month streak!!)
TheRavenFile ๐ฅ on ThreatFox
whack_sh ๐ฅ on MalwareBazaar
Go see the full Top10 leaderboards
๐ community.abuse.ch
#SharingisCaring #Leaderboards #Community ๐
3
6
19
2,027
We recently sinkholed a DDoS #botnet of 200,000 compromised Android TV boxes infected with #CECbot malware ๐ต๏ธโโ๏ธ. Shortly after, the threat actor responded by registering a rather specific botnet C2 domain ๐
๐ก spamhaushackers .at
Nice try, but their new C2 domain is already flagged๐. Its authoritative DNS runs on DNSPod (*.dnspod.com), which has carried a poor reputation for years! ๐ก
โคต๏ธโคต๏ธโคต๏ธโคต๏ธ
hunting.abuse.ch/hunt/6aa7e8โฆ
ALT abuse.ch Hunting
4
18
68
9,036
๐จ ANNOUNCEMENT FOR TOP CONTRIBUTORS! ๐จ
Weโve been working on something huge and the cat ๐ is finally out of the bag ๐ ...ย abuse.ch and Spamhaus have officially partnered with Modat (@modat_magnify) to give FREE Magnify licenses to our top contributors! ๐๐ฅ
You give your time, brainpower, and expertise to this community ๐. You hunt down the bad guys every single day - we want to make sure you have the best tools ๐ ๏ธ to do what you do for the good of the internet every single day!
Consider this our way of saying THANK YOUย ๐ย ๐
Top contributors - keep an eye out, we'll be reaching out in the coming weeks to get your access sorted.
More details in comments ๐
1
9
22
3,093
#BoratRAT spreading using similar tactics as #ClickFix ๐
1๏ธโฃ Fake Microsoft Security Verification ๐ leading to malicious PowerShell execution ๐ฑ๏ธ
2๏ธโฃ Command triggers a DNS TXT request to recapture-robot .today ๐ to obtain a PowerShell script ๐
3๏ธโฃ Script drops payload, infecting host with BoratRAT ๐ป
Payload delivery:
๐ recapture-robot .today (PDR ๐ฎ๐ณ)
๐ 91.193.7.186:49094 (M247 ๐ฏ๐ต)
Botnet C2:
๐ก out-agent.duckdns .org
๐ก 91.193.7.186:48988 (M247 ๐ฏ๐ต)
๐ Sample:
bazaar.abuse.ch/sample/5a8abโฆ
ALT BoratRAT spreading through a ClickFix like lure
ALT Botnet C2 serving "BoratRat" SSL certificate
ALT Malicious DNS TXT record serving a PowerShell script, leading to malware infection with BoratRAT
2
27
80
7,296
Overlord RAT ๐ dropped by Amadey loader ๐ฅ
Botnet C2 server:
mypamella .xyz โก๏ธ NameSilo ๐บ๐ธ
136.175.82.88:443 โก๏ธ 2ETELECOM๐ง๐ฌ
Payload is bulletproof hosted ๐ก๏ธat Omegatech LTD ๐ณ๐ฑ
๐ urlhaus.abuse.ch/url/3906755โฆ
๐ Malware sample:
bazaar.abuse.ch/sample/ac1f8โฆ
๐ฆ Further IOCs on ThreatFox:
threatfox.abuse.ch/browse/maโฆ
Admin panel โคต๏ธ
ALT Overlord RAT botnet admin panel
2
16
63
6,177
NeedleStealer ๐ชก๐ช written in Go โคต๏ธ
๐ HTTP user agents observed:
User-Agent: Loader-cli/v1
user-agent: Go-http-client/2.0
๐ก Botnet C2s, all behind Cloudflare CDN:
http://woolvilli .com/api/v2
http://allremdeskriki .com/api/v2
http://dubl1allremriki .com/api/v2
http://dubl2allremriki .com/api/v2
๐ก Related C2 infrastructure at Vultr ๐ณ๐ฑ:
http://136.244.100 .54:8899/api/v1/agent/register
http://136.244.100 .54:8899/api/v1/agent/ws
โฑ๏ธ Artifacts:
\Sessions\1\BaseNamedObjects\Local\NeedleRemoteAgentSingle
C:\Users\user\AppData\Local\Temp\needle-2fa
๐ Malware samples:
bazaar.abuse.ch/browse/signaโฆ
๐ฆ Relevant IOCs are on ThreatFox:
threatfox.abuse.ch/browse/taโฆ
Stealer admin panelโคต๏ธ
ALT NeedleStealer botnet admin panel
3
27
68
8,742
We identified a new malware called #HypeAgent which acts as information stealer & loader. It is dominantly spread through malspam ๐ง, first observed on August 1, 2026 ๐ญ๐
Key Capabilities โคต๏ธ
๐ต๏ธ Stealer & Loader: Supports 200+ commands; drops/executes payloads, including crypto miners ๐ธ
๐ Targeted Harvesting: Steals web browser & email credentials, crypto wallets, and gaming accounts (Steam, Roblox) ๐ฎ
๐ค AI & Platform Cookie Stealing: Targets a list of hardcoded domains like Grok, Anthropic, Coinbase, ByBit, Instagram, and Rockstar Games for which it steals session cookies ๐ช
๐ฐ Electron App Webinjects: Intercepts activity on desktop apps like Exodus Wallet ๐
Artifacts observed โคต๏ธ
1๏ธโฃ Stores stealers logs under C:\Users\USERNAME\AppData\Local\Temp\hype-YYYY-MM-DD.log
2๏ธโฃ Uses HTTP host header "X-Hype-Agent-Token" during botnet C2 communication
HypeAgent communicates via WebSocket using JSON. Here are some Botnet C2 servers we have been observed โคต๏ธ
๐ก 31.40.204.178:7080 WhiteLabel ๐น๐ท
๐ก 94.26.3.211:7443 Stellar Group SAS ๐ซ๐ท
๐ก 192.109.139.91:7443 Stellar Group SAS ๐บ๐ธ
๐ก 195.177.94.60:7443 Stellar Group SAS ๐ซ๐ท
๐ก 107.175.148.122:7443 HostPapa ๐บ๐ธ
๐ก 209.54.103.173:7443 HostPapa ๐บ๐ธ
๐ก 132.243.225.173:7080 QWINS-Hosting ๐ฉ๐ช
๐ก 78.40.209.113:7081 QWINS-Hosting ๐ซ๐ฎ
๐ก 31.77.138.55:5654 QWINS-Hosting ๐ซ๐ฎ
๐ฆ Releated IOCs on ThreatFox:
threatfox.abuse.ch/browse/taโฆ
๐ Releated malware samples on MalwareBazaar:
bazaar.abuse.ch/browse/signaโฆ
ALT HypeAgent botnet C2 communication observed during tria.ge sandbox run
1
22
64
6,761
abuse.ch retweeted
๐ข HUNTERS WANTED: Thereโs still time to join our small group of experts helping shape a new CTI hunting platform from Spamhaus and @abuse_ch.
We're looking for people who:
โก๏ธ Run structured CTI/detection-engineering workflows
โก๏ธ Write and maintain YARA rules
โก๏ธ Consume data programmatically
โก๏ธ Understand TLP governance and public/private boundaries
We want to build it with people who know these challenges first-hand: running detections at scale, dealing with noisy results, building and maintaining complex infrastructure, and struggling to get to actionable intelligence.
Commitment is light-touch this year - an hour or two a month - with early access when the beta opens.
Does this sound like you or someone you know? Read on, or share the link below to find out more ๐ hubs.ly/Q04sKM3D0
#ThreatIntel #YARA #ThreatHunting
3
5
800
StealC C2 domains dropping OverlordRAT, using CloudFlare and Microsoft look-a-like domains ๐๏ธ
๐ cloud-flare-authenticator .link
๐ cloud-flare-authenticator .click
๐ update-microsoft-data .services
๐ก 89.34.90.45:443
OverlordRAT #botnet C2 server โคต๏ธ
๐ download-windows-update .live
๐ก 151.243.113.94:5173
Both hosted at AS207043 DEDIK-IO in Germany๐ฉ๐ช
๐ Malware sample:
bazaar.abuse.ch/sample/5c61cโฆ
๐ฆ IOCs on ThreatFox:
threatfox.abuse.ch/browse/maโฆ
threatfox.abuse.ch/browse/taโฆ
1
17
67
6,813
Over the past days, active #malspam campaigns targeting LatAm users ๐ฆ๐ท๐ง๐ท๐ฒ๐ฝ have been delivering the Grandoreiro banking trojan ๐ฆ๐ฐ
๐ง Email โ ๐ JS file โ ๐ Fake PDF download
Final payload is hosted on MediaFire ๐ฅ free file hosting
C2 network traffic is rather trivial to detect as #Grandoreiro is using Embarcadero Delphi compilation tools' HTTP user agent ๐ฅ๏ธโคต๏ธ
User-Agent: Embarcadero URI Client/1.0
๐ Botnet C2 domain resolved via Google DNS-over-HTTPS (DoH): devilmaycry.servehumour .com ๐
๐ก Grandoreiro botnet C2s hosted at AWS:
54.80.154.193
54.91.129.132
54.91.223.28
๐ Payloads URLs:
urlhaus.abuse.ch/browse/tag/โฆ
๐ Malware samples:
bazaar.abuse.ch/browse/signaโฆ
๐ฆ Relevant IOCs are available on ThreatFox:
threatfox.abuse.ch/browse/maโฆ
ALT Grandoreiro malspam targeting LatAm internet users
ALT Grandoreiro malspam targeting LatAm internet users
ALT Grandoreiro malspam targeting LatAm internet users
ALT Fake Adobe PDF document download leading to Grandoreiro
3
13
44
4,561
Rogue #ScreenConnect RMM cluster using a fake @COLDCARDwallet domain to lure crypto wallet owners ๐ฐ into downloading a fake DocuSign MSI which drops ScreenConnect ๐ฑ๏ธ๐ฅ๏ธ
โ๏ธ Attack Chain:
Threat actor domain โก๏ธ GitHub repo โก๏ธ ScreenConnect
๐ Fake #COLDCARD domain with opendir:
hardware-data .com โก๏ธ Tucows Domains ๐บ๐ธ
โ๏ธ Rogue GitHub user with 19 code repositories:
github.com/kaswareteam/
๐ ScreenConnect RMM botnet C2s (Port 8041 TCP):
๐บ๐ธ DeltaHost :
hitpanels .com โก๏ธ 185.174.101.132
hitspanels .com โก๏ธ 185.174.101.132
๐บ๐ธ 1337 Services GmbH:
vicspanel .com โก๏ธ 155.2.192.94
hitstp .com โก๏ธ 155.2.192.235
vps133panel .com โก๏ธ 203.159.90.31
๐ฆ IOCs on ThreatFox:
threatfox.abuse.ch/browse/taโฆ
๐ Payload delivery URLs on URLhaus:
urlhaus.abuse.ch/browse/tag/โฆ
ALT Fake COLDCARD domain with opendir, leading to rogue ScreenConnect RMM payload
ALT Rogue GitHub user with 19 malicious code repositories
ALT Rogue COLDCARD website luring the users into downloading a fake DocuSign package which leads to ScreenConnect RMM
2
6
17
3,542
๐ข SERVICE UPDATE | As you may have noticed, we've experienced some downtime recently which was largely caused by a small number of users exceeding our Fair Use Policy.
To protect platform stability and ensure fair access for everyone as our user base grows, we are introducing API rate limits. Accounts generating unusually high query volumes may be temporarily limited for up to 72 hours.
Repeated or persistent abuse may result in longer-term restrictions on API access.
1
3
2,452