Statistics
Most Delivery Payload
Average Takedown TimeNumber of submissions (past 30 days)
The chart below documented the number of submissions (unique malware URL) to URLhaus per day over a period of 30 days.
Top Reporters
It wouldn't be possible to operate URLhaus without the help of volunters who report malware URLs to URLhaus. The table below shows the top reporters and their Twitter handle.
| Rank | Reporter | Submissions |
|---|---|---|
| 1 | @zbetcheckin | 21'017 |
| 2 | @JRoosen | 16'494 |
| 3 | @Cryptolaemus1 | 8'622 |
| 4 | @unixronin | 7'804 |
| 5 | @Techhelplistcom | 5'650 |
| 6 | @JAMESWT_MHT | 4'504 |
| 7 | @ps66uk | 4'228 |
| 8 | @abuse_ch | 4'078 |
| 9 | @cocaman | 3'337 |
| 10 | @lovemalware | 2'455 |
| 11 | @oppimaniac | 2'355 |
| 12 | @p5yb34m | 2'181 |
| 13 | @bjornruberg | 1'612 |
| 14 | @de_aviation | 1'397 |
| 15 | @_nt1 | 807 |
Most Delivered Payload
Malware URLs deliver all kind of different payloads. This chart shows the number of payload per malware family (signature) identified / crawled by URLhaus.
Top Tags
Most seen tag associated with malware URLs tracked by URLhaus.
Top Malware Hosting Networks
The chart below shows the top malware hosting network by ASN. Please consider that some of them just offer CDN or proxy services and are hence not hosting the malicious content it self rather than facilitate delivering the malicious payload to the user.
Top malware hosting networks in total (counting online and offline malware distribution sites):
| Rank | ASN | Country | Average Reaction Time | Malware URLs |
|---|---|---|---|---|
| 1 | AS14061 DIGITALOCEAN-ASN - DigitalOcean, LLC |  CA | 6 days, 6 hours, 52 minutes | 6'721 |
| 2 | AS26496 AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC |  US | 9 days, 5 hours, 18 minutes | 5'207 |
| 3 | AS16276 OVH |  FR | 5 days, 23 hours, 51 minutes | 3'087 |
| 4 | AS46606 UNIFIEDLAYER-AS-1 - Unified Layer | US | 2 days, 10 hours, 58 minutes | 2'950 |
| 5 | AS50673 SERVERIUS-AS |  NL | 4 days, 11 hours, 21 minutes | 1'789 |
| 6 | AS31034 ARUBA-ASN |  IT | 6 days, 3 hours, 49 minutes | 1'302 |
| 7 | AS16509 AMAZON-02 - Amazon.com, Inc. |  IE | 8 days, 1 hours, 21 minutes | 1'173 |
| 8 | AS20013 CYRUSONE - CyrusOne LLC | US | 5 days, 18 hours, 30 minutes | 1'109 |
| 9 | AS13335 CLOUDFLARENET - Cloudflare, Inc. | US | 13 days, 7 hours, 9 minutes | 1'088 |
| 10 | AS24940 HETZNER-AS |  DE | 2 days, 11 hours, 6 minutes | 1'038 |
| 11 | AS15169 GOOGLE - Google LLC | US | 8 days, 9 hours, 30 minutes | 1'027 |
| 12 | AS32244 LIQUIDWEB - Liquid Web, L.L.C | US | 12 days, 4 hours, 42 minutes | 1'011 |
| 13 | AS6724 STRATO STRATO AG | DE | 1 day, 9 hours, 34 minutes | 911 |
| 14 | AS53667 PONYNET - FranTech Solutions | US | 13 days, 8 hours, 31 minutes | 857 |
| 15 | AS34619 CIZGI |  TR | 12 days, 7 hours, 27 minutes | 845 |
Top malware hosting networks, hosting active malware content (counting online malware distribution sites only):
| Rank | ASN | Country | Average Reaction Time | Malware URLs |
|---|---|---|---|---|
| 1 | AS14061 DIGITALOCEAN-ASN - DigitalOcean, LLC | US | 6 days, 6 hours, 52 minutes | 354 |
| 2 | AS4134 CHINANET-BACKBONE No.31,Jin-rong Street |  CN | 1 month, 9 days, 22 hours, 25 minutes | 259 |
| 3 | AS48815 CRITICALCASE | IT | 21 hours, 58 minutes | 151 |
| 4 | AS60144 THREE-W-INFRA-AS -- TRANSIT -- | NL | 9 days, 10 hours, 25 minutes | 141 |
| 5 | AS46606 UNIFIEDLAYER-AS-1 - Unified Layer | US | 2 days, 10 hours, 58 minutes | 139 |
| 6 | AS16276 OVH | FR | 5 days, 23 hours, 51 minutes | 135 |
| 7 | AS4837 CHINA169-BACKBONE CHINA UNICOM China169 Backbone | CN | 1 month, 24 days, 21 hours, 48 minutes | 116 |
| 8 | AS53667 PONYNET - FranTech Solutions | US | 13 days, 8 hours, 31 minutes | 96 |
| 9 | AS36352 AS-COLOCROSSING - ColoCrossing | US | 13 days, 14 hours, 9 minutes | 74 |
| 10 | AS13335 CLOUDFLARENET - Cloudflare, Inc. | US | 13 days, 7 hours, 9 minutes | 66 |
| 11 | AS8342 RTCOMM-AS |  RU | 10 days, 9 hours, 6 minutes | 66 |
| 12 | AS37963 CNNIC-ALIBABA-CN-NET-AP Hangzhou Alibaba Advertising Co.,Ltd. | CN | 1 month, 2 days, 3 hours, 45 minutes | 57 |
| 13 | AS34619 CIZGI | TR | 12 days, 7 hours, 27 minutes | 55 |
| 14 | AS15169 GOOGLE - Google LLC | US | 8 days, 9 hours, 30 minutes | 53 |
| 15 | AS8560 ONEANDONE-AS Brauerstrasse 48 | US | 13 days, 9 hours, 2 minutes | 50 |
Takedown Statistics
URLhaus is sending out abuse reports to hosting providers, hosting malware distribution sites. The following chart shows the number of active malware distribution sites and the number of unique abuse reports sent per day.
The following table shows the top 15 hosting providers with the fastest abuse desks. To generated these statistics, URLhaus measures the time between when URLhaus sent the abuse complaint to the hosting provider and when the reported content goes offline. Please consider that the accuracy is +/- 1 hour.
| Rank | ASN  | Country | Online | Offline | Average Reaction Time |
|---|---|---|---|---|---|
| 1 | AS34243 WEBAGE |  GB | 0 | 1 | 9 minutes |
| 2 | AS16912 4-LESS-NETWORK - 4 Less Communications, Inc. | US | 0 | 1 | 11 minutes |
| 3 | AS197595 OBE |  SE | 0 | 1 | 12 minutes |
| 4 | AS7540 HKCIX-AS-AP HongKong Commercial Internet Exchange |  HK | 0 | 1 | 18 minutes |
| 5 | AS204983 CYBERFUSION | NL | 0 | 1 | 23 minutes |
| 6 | AS198371 NINET |  RS | 0 | 1 | 25 minutes |
| 7 | AS7859 PAIR-NETWORKS - pair Networks | US | 0 | 1 | 26 minutes |
| 8 | AS132937 DIADEM-AS Diadem Technologies Pvt. Ltd. |  IN | 0 | 1 | 26 minutes |
| 9 | AS201563 AVALON-AS |  HR | 0 | 1 | 28 minutes |
| 10 | AS60819 SAFENAMES-AS | GB | 0 | 1 | 29 minutes |
| 11 | AS34358 CLAXTELECOM |  RO | 0 | 1 | 30 minutes |
| 12 | AS8278 TUC-AS |  GR | 0 | 1 | 32 minutes |
| 13 | AS2614 ROEDUNET | RO | 0 | 1 | 33 minutes |
| 14 | AS62370 SNEL | NL | 0 | 9 | 36 minutes |
| 15 | AS25386 INTERTELECOM-AS |  UA | 0 | 1 | 39 minutes |
The following table shows the top 15 hosting providers with the slowest abuse desks. To generated these statistics, URLhaus measures the time between when URLhaus sent the abuse complaint to the hosting provider and when the reported content goes offline. Please consider that the accuracy is +/- 1 hour.
| Rank | ASN  | Country | Online | Offline | Average Reaction Time |
|---|---|---|---|---|---|
| 1 | AS29468 INFRACOM | SE | 0 | 1 | 3 months, 23 days, 10 hours, 2 minutes |
| 2 | AS50482 KAZAKHTELECOM-AS |  KZ | 0 | 7 | 3 months, 18 days, 7 hours, 2 minutes |
| 3 | AS134771 CHINANET-SICHUAN-CHENGDU-MAN CHINANET Sichuan province Chengdu MAN network | CN | 2 | 4 | 3 months, 14 days, 16 hours, 8 minutes |
| 4 | AS204343 COMPUBYTE-AS | RU | 0 | 2 | 3 months, 13 days, 8 hours, 53 minutes |
| 5 | AS28195 Com4 Data Center Eireli EPP |  BR | 0 | 1 | 3 months, 11 days, 8 hours, 20 minutes |
| 6 | AS9394 CTTNET China TieTong Telecommunications Corporation | CN | 11 | 1 | 3 months, 9 days, 15 hours, 43 minutes |
| 7 | AS136639 SCUD-AS-IN Scud Communication Pvt Ltd | IN | 0 | 6 | 3 months, 9 days, 13 hours, 59 minutes |
| 8 | AS4812 CHINANET-SH-AP China Telecom (Group) | CN | 2 | 8 | 3 months, 9 days, 4 hours, 21 minutes |
| 9 | AS15133 EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business | US | 0 | 2 | 3 months, 8 days, 19 hours, 56 minutes |
| 10 | AS17623 CNCGROUP-SZ China Unicom Shenzen network | CN | 0 | 1 | 3 months, 0 days, 17 hours, 28 minutes |
| 11 | AS136800 XIAOZHIYUN-AS ICIDC NETWORK | HK | 0 | 1 | 3 months, 0 days, 3 hours, 31 minutes |
| 12 | AS23889 MauritiusTelecom |  MU | 0 | 3 | 2 months, 29 days, 15 hours, 8 minutes |
| 13 | AS1273 CW Vodafone Group PLC | DE | 0 | 13 | 2 months, 24 days, 21 hours, 55 minutes |
| 14 | AS4847 CNIX-AP China Networks Inter-Exchange | CN | 1 | 12 | 2 months, 22 days, 17 hours, 49 minutes |
| 15 | AS24323 AAMRA-NETWORKS-AS-AP aamra networks limited |  BD | 0 | 14 | 2 months, 22 days, 17 hours, 43 minutes |
The full list of average reaction time over all hosting providers (ASNs) can be found here:
If you are a hosting provider, network owner or national CERT, you can subscribe to the URLhaus feed for your ASN or country here: