URLhaus project takes down 100K malware sites
Abuse.ch's URLhaus project used community reporting to take down nearly 100,000 malware distribution sites in 10 months, most linked to Emotet.
Sourceabuse.ch — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
This is a retrospective report from abuse.ch on its URLhaus project, launched in March 2018 to crowdsource identification and takedown of malware distribution URLs. Over the project's first 10 months, 265 contributing researchers submitted an average of 300 malicious URLs per day, resulting in nearly 100,000 takedowns, though 4,000-5,000 sites remain active at any given time. The article highlights persistent problems with hosting provider abuse-desk response times, noting an average takedown time of over 8 days globally and over a month for top Chinese hosting networks, with US and Chinese providers hosting two-thirds of the top malware hosting networks.
The report identifies Emotet (aka Heodo) as the dominant malware family behind the tracked distribution sites, spread via malspam campaigns using malicious macro-enabled Office documents that download and execute the payload from compromised websites. Some campaigns host the malicious document on a compromised site rather than attaching it directly to evade spam filters. Of roughly 380,000 malware samples collected by URLhaus over the period, Emotet/Heodo was the top payload identified. The piece is largely a project retrospective and community call-to-action, encouraging network owners, CERTs, and TLD operators to subscribe to URLhaus feeds and implement its blocklists (DNS RPZ, Snort/Suricata rules) rather than describing a new or active threat campaign.
Mentioned in this report
Source reporting: https://abuse.ch/blog/how-to-takedown-100000-malware-sites
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs