Malware Activity: Key Statistics Quarter over Quarter comparison: April 1,2025 - June 30,2025

Each reporting period, we analyze URLs, domain names, and IP addresses reported for serving up or distributing malware. We use these and other metadata — domain and IP address registration data, ICANN registry and registrar monthly reports, routing data, attack type, and other indicators — to report key statistics for each reporting period.

We compare number of domains reported for hosting malware in TLDs for two consecutive quarters in the table below.

Complete lists of Top-level Domains, gTLD registrars and hosting networks (ASNs) where malware was reported for the quarter can be downloaded in CSV format from the Records page.

Measurement January to March 2025 April to June 2025 Change
in
Measurement
Total number of malware reports collected from feeds (per quarter) 1,490,810 1,296,923 -193,887
Total number of malware records produced from malware reports 1,353,457 1,201,600 -151,857
Endpoint malware (targets user-attended devices) 69,015 46,326 -22,689
Internet of Things (IoT) malware (targets sensors, wearables, appliances...) 83,071 46,305 -36,766
Malicious IP address malware records (Traffic Injectors and Attackware) 1,069,804 1,021,858 -47,946
Uncategorized malware (Verified as malware but not classified) 131,567 87,111 -44,456
Unique domain names reported for serving up malware 25,277 23,352 -1,925
Top-level Domains (TLDs) where we observed malware hosting 374 342 -32
Registrars that had gTLD domains under management reported for serving malware 393 547 154
Hosting Networks (ASNs) where we observed malware hosting or distribution 14,966 16,304 1,338
Unique IPv4 addresses reported as serving or distributing malware 1,104,514 1,042,924 -61,590