Keeping the Internet Safe and secure.

// SECURITY

Detecting and documenting phishing campaigns, malware distribution, DNS abuse and fraudulent domain infrastructure — and sharing what we find with the operators who can act on it.

URLAbuse is an open threat intelligence project we run to expose malicious infrastructure on the Internet — phishing pages, malware distribution URLs, hacked websites, and abusive domains such as fake shops or illegal gambling sites. We collect suspects through honeypots, automated scanners and community submissions, verify each one with concrete evidence (screenshots, IP, ASN, registrar data), and forward confirmed cases to registries, registrars, CERTs and other stakeholders who can act on them. The verified data is published as a free, open blocklist feed — no clutter, no guesswork, just actionable evidence anyone can use to make their own systems safer.

Building block lists, indicators of compromise and threat intelligence feeds that help networks and users avoid malicious domains, phishing sites and malware before harm is done.

Public recursive DNS resolvers (e.g., Quad9) are using our blocklist (URLAbuse DBL), to protect their users from online harm at the DNS resolution level.

Studying and measuring the DNS, routing and core Internet infrastructure, and building open measurement tools to make that data available to the wider research community.
We have conducted several research projects to detect malicious infrastructure, in collaboration with law enforcement agencies and major financial institutions, aiming to reduce potential financial damage and victimization.

Publishing our tools, datasets and research as open source — because the infrastructure that secures the Internet works best when it can be inspected, reused and improved by others.