Malware Activity: Key Statistics Quarter over Quarter comparison: January 1,2026 - March 31,2026

Each reporting period, we analyze URLs, domain names, and IP addresses reported for serving up or distributing malware. We use these and other metadata — domain and IP address registration data, ICANN registry and registrar monthly reports, routing data, attack type, and other indicators — to report key statistics for each reporting period.

We compare number of domains reported for hosting malware in TLDs for two consecutive quarters in the table below.

Complete lists of Top-level Domains, gTLD registrars and hosting networks (ASNs) where malware was reported for the quarter can be downloaded in CSV format from the Records page.

Measurement October to December 2025 January to March 2026 Change
in
Measurement
Total number of malware reports collected from feeds (per quarter) 1,234,448 1,867,472 633,024
Total number of malware records produced from malware reports 1,078,260 1,755,034 676,774
Endpoint malware (targets user-attended devices) 91,619 84,942 -6,677
Internet of Things (IoT) malware (targets sensors, wearables, appliances...) 47,417 38,863 -8,554
Malicious IP address malware records (Traffic Injectors and Attackware) 866,913 1,577,914 711,001
Uncategorized malware (Verified as malware but not classified) 72,311 53,315 -18,996
Unique domain names reported for serving up malware 17,578 37,260 19,682
Top-level Domains (TLDs) where we observed malware hosting 298 315 17
Registrars that had gTLD domains under management reported for serving malware 317 385 68
Hosting Networks (ASNs) where we observed malware hosting or distribution 19,658 22,024 2,366
Unique IPv4 addresses reported as serving or distributing malware 882,477 1,592,939 710,462

Quarterly Update:
Key Statistics
Quarter over Quarter:
Key Statistics		 Quarter over Quarter:
Top Level Domains		 Quarter over Quarter:
Registrars		 Quarter over Quarter:
Hosting Networks