Abuse.ch

Abuse.ch
Name	Abuse.ch
Type	Non-profit project
Founded	2008
Founder	Thomas Schaerer
Location	Switzerland
Focus	Cybersecurity, malware analysis, threat intelligence

Abuse.ch Abuse.ch is a Swiss-based nonprofit project that provides free data feeds, malware analysis, and threat intelligence to support global computer security operations, internet service providers, law enforcement and incident response teams. The project produces technical reports and blocklists used by security researchers, system administrators, network operators, and journalists to disrupt botnet infrastructure, malicious domains, and malware distribution. Its repositories and feeds have been cited in publications by CERT/CC, Europol, Interpol, and academic groups studying cybercrime.

Overview

Abuse.ch operates a collection of collaborative platforms and open feeds that aggregate indicators of compromise (IOCs), including domain names, IP addresss, SSL certificate fingerprints, and malware samples. Its outputs are consumed by SIEM products, antivirus vendors, threat intelligence platforms, and volunteer-run honeypot networks. The project emphasizes transparency, reproducibility, and free access, aligning with principles advanced by organizations such as EFF, Open Source Initiative, Apache Software Foundation, and Creative Commons-licensed research communities.

History and Development

Founded in 2008 by Swiss security researcher Thomas Schaerer, Abuse.ch grew from an individual blog-style analysis into a set of coordinated services. Early work intersected with research from SANS Institute, US-CERT, DFRWS, and university labs including ETH Zurich and University of Cambridge that studied botnets like Zeus and Conficker. Over time, the project responded to emergent threats such as Ransomware, Banking Trojan campaigns, and malicious cryptocurrency miners by developing automated collection and distribution mechanisms inspired by tools from MISP and standards from STIX and TAXII. Collaborations and data sharing expanded alongside partnerships with regional entities like Europol, ENISA, Swiss Federal Office of Police, and research groups at Carnegie Mellon University and TU Delft.

Projects and Services

Abuse.ch hosts multiple specialized services that target discrete classes of threats. Notable services include blocklists and feeds for malicious domains, command-and-control (C2) infrastructures, and drive-by download sites used by exploit kits such as Angler and Neutrino. The project integrates with sample repositories and sandboxing platforms like VirusTotal, Cuckoo Sandbox, and Hybrid Analysis to augment metadata. Its datasets are consumed by ISP abuse desks, security operation center (SOC) teams, cloud providers such as Amazon Web Services and Microsoft Azure, and content delivery networks including Akamai and Cloudflare. Abuse.ch also publishes analytical write-ups used by investigative journalists at outlets such as Krebs on Security, BleepingComputer, and The Register.

Impact and Notable Investigations

Feeds and analyses from the project have been instrumental in takedowns, sinkholing efforts, and attribution work connected to botnets and malware families. Intelligence derived from its feeds contributed to disruption operations against Zeus, SpyEye, and Dridex-related infrastructures, and supported #Operation Tovar style collaborations. Data from its C2 trackers aided research by Group-IB, Symantec, ESET, and Kaspersky Lab into advanced persistent threat actors and financially motivated cybercriminal networks. Investigative timelines referencing Abuse.ch resources have appeared in reports by NCSC UK, US Department of Justice, and FBI cyber units during prosecutions and international enforcement actions.

Organizational Structure and Funding

The project is volunteer-driven with a core maintainer team and contributions from independent researchers, academic partners, and industry collaborators. Governance resembles a community-run model similar to The Tor Project and Let’s Encrypt in operational openness but with a lean staffing pattern common to many nonprofit technical initiatives. Funding and operational costs have been supported through donations, sponsorships, grants from cybersecurity foundations, and in-kind support from platform providers. Software and data sharing practices align with norms from Open Source Initiative and research funding bodies at institutions like National Science Foundation and European Research Council.

Criticism and Controversies

Abuse.ch’s public blocking lists and takedown assistance have drawn debate over collateral damage, false positives, and due process—issues also discussed in contexts involving Google, Facebook, and Twitter content moderation. Critics from academic and legal communities including scholars at Harvard Law School and Max Planck Institute have raised questions about transparency, appeal mechanisms, and potential impacts on benign research domains. Operational tensions have arisen with commercial security vendors and hosting providers such as GoDaddy and OVH when automated feeds trigger service disruptions. The project has responded by improving whitelist procedures, publishing methodology notes, and coordinating with entities like FIRST and regional CERTs to mitigate unintended consequences.

Category:Cyber threat intelligence