Platform docs
Public datasets
How the public malware database, live threat map, IP blacklist, and file reports are produced, what they contain, and how to use them responsibly.
- Malware database: searchable specimen records by SHA-256, TB identifier, family, and type.
- Live threat map: geographic view of observed activity by country and malware family.
- IP blacklist: network addresses extracted from analysed specimens, with role, confidence, and linked specimens.
- File reports: per-specimen static analysis, indicators, and relations.
Until the analysis pipeline publishes live results, these pages run on deterministic demonstration data so the interfaces can be reviewed. Demonstration IP addresses come only from ranges reserved for documentation (RFC 5737 and RFC 3849), and network numbers come from the documentation ASN range, so nothing on these pages identifies a real host or operator.
The IP blacklist can be copied as a plain list or downloaded as CSV. Every CSV cell that could be read as a spreadsheet formula is escaped, so opening an export in Excel or Sheets cannot execute content from the data.
An address appearing in the blacklist means it was observed in malware, not that its owner is responsible. Command servers are frequently compromised third-party machines. Use the confidence and role fields when deciding whether to block, and report suspected false positives through the contact page so they can be reviewed and corrected.