Malware Activity: Key Statistics
January 1, 2022 - March 31, 2022
We analyzed URLs, domain names, and IP addresses that have been reported for malware. These and other metadata - e.g., registration data, DNS zone data, and malware typing provided by the feed - allow us to determine what malware was most prevalent, where malware was served from or distributed, and what resources criminals used to pursue their attacks.
Indicators of compromise allow us to distinguish hostnames delegated from domains that were purposely registered for malware campaigns from hostnames assigned to compromised web sites that were delegated from domain names for legitimate purposes.
During this period, we measured malware reports and the number of unique domain names or IPv4 addresses that were reported as serving up malware. We classified malware as targeting endpoint devices or Internet of Things (IoT) devices, and measured by class as well.
In many cases the identification of a malware in reports that we ingest is definitive, but the malware report lacks the information necessary to confidently classify the malware as “Endpoint Malware” or “IoT Malware”. For the purposes of analysis and reporting, these cases are represented as “uncategorized”.
We include counts of uncategorized malware in our TLD, Registrar and Hosting Networks rankings.
| Measurement | Count |
|---|---|
| Total number of malware reports collected from feeds this quarter | 2,824,937 |
| Total number of malware records produced from malware reports | 599,379 |
| Endpoint malware records (targets user-attended devices) | 193,703 |
| Internet of Things (IoT) malware records (targets sensors, wearables, appliances...) | 232,355 |
| Uncategorized malware (Verified as malware but not classified) | 173,321 |
| Unique domain names reported for serving up malware | 48,176 |
| Top-level Domains (TLDs) where we observed malware hosting | 387 |
| Registrars that had gTLD domains under management reported for serving malware | 1,080 |
| Hosting Networks (ASNs) where we observed malware hosting or distribution | 5,144 |
| Unique IPv4 addresses reported as serving or distributing malware | 135,517 |