Malware files and patterns
Fingerprints (SHA-256) of known malware and detection patterns for web shells and injected code, from public rule sets and from malware our own scans and honeypots find.
Threat feed
One signed threat database, with every source named.
Every Cyber Securitise site downloads the same signed list once a day: known malware files and patterns, phishing and malware sites, and networks to keep out. Here is what goes into it, who it comes from and under which licence.
What we collect
Phishing and malware sites
Domains that host phishing pages or spread malware. A site links to one: you see a finding.
Networks
Hijacked and criminal networks (always blocked), plus Tor exits, VPNs and data centres for sites that choose to block them.
Vulnerabilities
Known holes in WordPress, plugins, themes and the libraries they bundle, with the ones attackers are using right now marked.
We publish counts only. The entries themselves go to sites inside the signed bundle and are never listed on this page.
In the database now
—malware files
—malware patterns
—phishing and malware sites
—networks
—components with known vulnerabilities
—actively exploited vulnerabilities
Sources, credits and licences
Only sources whose licence allows a commercial product to use their data are imported. Each entry records which sources list it, so credits follow the data.
Malware files and patterns
| Source | What it gives | Licence | Updated | Entries |
|---|---|---|---|---|
| Linux Malware Detect signatures© R-fx Networks, Ryan MacDonald | Web malware fingerprints and patterns | GPL-2.0 | Daily | — |
| signature-baseFlorian Roth (Nextron Systems) and each rule’s author, named in every finding | Web shell detection rules | Detection Rule License 1.1 | Daily | — |
| Pressidium YARA rulesPressidium | WordPress malware rules | GPL-3.0 | Daily | — |
| Yara-Rules (webshells)The Yara-Rules project and rule authors | Web shell rules | GPL-2.0 | Daily | — |
| php-malware-finderjvoisin and contributors | PHP malware rules (those that convert exactly) | LGPL-3.0 | Daily | — |
Phishing and malware sites
| Source | What it gives | Licence | Updated | Entries |
|---|---|---|---|---|
| Phishing.Database© Mitchell Krog, Nissar Chababy and contributors | Active phishing domains | MIT | Daily | — |
| CERT Polska warning listCERT Polska / NASK-PIB (no endorsement implied) | Phishing and scam domains | Any use | Daily | — |
Networks and countries
| Source | What it gives | Licence | Updated | Entries |
|---|---|---|---|---|
| Spamhaus DROP and ASN-DROP© The Spamhaus Project SLU | Hijacked and criminal networks | Spamhaus DROP terms | Daily (at most once a day) | — |
| iptoasn.comiptoasn.com | Address ranges of ASN-DROP networks | PDDL | Daily | — |
| Tor exit lists (CollecTor)The Tor Project | Tor exit addresses | CC0 | Daily | — |
| X4BNet lists_vpn© X4B (Mathew Heard) | VPN and data-centre ranges | MIT | Daily | — |
| IP Geolocation by DB-IPDB-IP.com | Country of an address, for country blocking | CC BY 4.0 | Monthly | — |
Vulnerabilities
| Source | What it gives | Licence | Updated | Entries |
|---|---|---|---|---|
| Wordfence Intelligence© Defiant Inc. | WordPress, plugins and themes | Wordfence Intelligence terms | Twice a day | — |
| GitHub Advisory Database (via OSV.dev)GitHub, Inc. | Composer and npm libraries | CC BY 4.0 | Daily | — |
| FriendsOfPHP security advisoriesFriendsOfPHP contributors | Composer libraries | Unlicense | Daily | — |
| CISA Known Exploited VulnerabilitiesCISA | Which vulnerabilities attackers use now | CC0 | Daily | — |
| NVDNIST | Severity scores (CVSS) | Public domain | Daily | — |
Sign-up spam
| Source | What it gives | Licence | Updated | Entries |
|---|---|---|---|---|
| disposable-email-domainsContributors | Throw-away email services | CC0 | Daily | — |
Our own findings
Malware that Cyber Securitise sites of two or more different customers report, and what our honeypot sites catch, reviewed by Novatise staff. Only fingerprints and counts leave a site.
- Search engine and AI crawler address ranges (Google, Bing, Apple, DuckDuckGo, OpenAI, Perplexity) are not copied: each site fetches them from the operator to tell real crawlers from fakes.
- For data from GPL and LGPL sources we keep each source archive for three years and send a copy on request.
- This product uses the NVD API but is not endorsed or certified by the NVD.
- Full notices and licence texts
How entries are trusted and retired
An entry listed by more independent sources, or also seen by our sites or honeypots, gets more confidence and goes first when the database is full.
A domain from a single weaker source is dropped 30 days after the source stops listing it (others after 90 days). File fingerprints stay.
Detection rules are converted only when the conversion keeps their meaning exactly; the rest are skipped.
The whole database is signed. Sites check the signature before using anything, and “mark as safe” on a site reports a likely false positive to us.