URLhaus takedown hits 100K malware sites

21 January 2019 medium threat

abuse.ch's URLhaus project took down nearly 100,000 malware distribution sites in 10 months, with Emotet/Heodo dominating the threat landscape and Chinese hosting providers averaging over a month to respond.

abuse.ch's URLhaus project, launched in March 2018, achieved a significant milestone by facilitating the takedown of nearly 100,000 malware distribution sites within its first 10 months of operation. The community-driven initiative relies on 265 security researchers worldwide who submit an average of 300 malicious URLs daily. Despite this success, URLhaus tracks between 4,000 and 5,000 active malware distribution sites daily, with an average takedown time of over 8 days.

Geographic analysis reveals that two-thirds of top malware hosting networks operate in the US or China, with Chinese hosting providers showing particularly poor response times averaging over a month. Emotet/Heodo represents the dominant threat, spread primarily through malspam campaigns that leverage compromised websites to host malicious Office documents or directly distribute the malware payload. Of 380,000 malware samples collected by URLhaus, Emotet consistently ranks as the top malware family.

The project demonstrates the effectiveness of community-based threat intelligence sharing, but highlights critical gaps in abuse desk response times and internet hygiene practices. abuse.ch recommends that ASN operators, CERTs, and domain registries subscribe to URLhaus feeds and implement available blocklists in DNS RPZ and IDS rule formats to protect their networks.

Mentioned in this report

Malware EmotetHeodo

Detection guidance

Office Application Spawning Script Interpreter or Command Shell

ATT&CK T1204.002

Detects Microsoft Office applications (Word/Excel/PowerPoint) spawning cmd.exe, powershell.exe, wscript.exe, mshta.exe or similar interpreters, a common pattern for malicious macro-laden documents delivering Emotet-style payloads. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Office Application Spawning Command or Script Interpreter
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \WINWORD.EXE
    - \EXCEL.EXE
    - \POWERPNT.EXE
    - \MSACCESS.EXE
    - \OUTLOOK.EXE
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \regsvr32.exe
    - \rundll32.exe
    - \bitsadmin.exe
    - \certutil.exe
  condition: selection_parent and selection_child
fields:
- ParentImage
- Image
- CommandLine
falsepositives:
- Legitimate Office add-ins or macros that call scripting engines for approved business
  automation
- IT-managed document templates that invoke PowerShell for internal reporting
level: high
tags:
- attack.t1204.002
- attack.t1566.001
id: ddc55f92-8f39-5df1-b80b-837b6225173b
status: experimental
author: Vorant

Office Application Initiating Outbound Network Connection

ATT&CK T1071.001

Detects Word/Excel/PowerPoint processes directly initiating outbound network connections, consistent with malicious macros reaching out to compromised web servers to download second-stage payloads such as Emotet. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Office Application Direct Outbound Network Connection
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
    - \WINWORD.EXE
    - \EXCEL.EXE
    - \POWERPNT.EXE
    - \MSACCESS.EXE
    Initiated: 'true'
    DestinationPort:
    - 80
    - 443
    - 8080
  filter:
    DestinationHostname|endswith:
    - .microsoft.com
    - .office.com
    - .office365.com
    - .live.com
  condition: selection and not filter
fields:
- Image
- DestinationIp
- DestinationHostname
- DestinationPort
falsepositives:
- Office telemetry, update checks, or add-in license validation to non-Microsoft cloud
  endpoints
- Legitimate document templates linking to external content servers over HTTP/HTTPS
level: medium
tags:
- attack.t1071.001
- attack.t1566.001
id: 41b61630-95d6-5b9e-a2bd-1f44ecb3682f
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://abuse.ch/blog/how-to-takedown-100000-malware-sites

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free