Active Malware Hosting Domains

The domains listed below are currently hosting active malware. These are not just historically flagged domains -- each entry has at least one confirmed online malware URL at the time of this page's last update. Malware-hosting domains distribute payloads including information stealers, banking trojans, remote access tools, and ransomware droppers. Blocking these domains at the DNS level is one of the most effective ways to protect your network.

#	Domain	Active Malware URLs	Total URLs Tracked	Status
1	raw.githubusercontent.com	18351	18351	ACTIVE THREAT
2	github.com	2311	2311	ACTIVE THREAT
3	gitlab.com	371	371	ACTIVE THREAT
4	firebasestorage.googleapis.com	47	47	ACTIVE THREAT
5	kpq.at	47	47	ACTIVE THREAT
6	cliftycreek.anondns.net	46	46	ACTIVE THREAT
7	everycarebd.com	42	42	ACTIVE THREAT
8	drive.google.com	33	33	ACTIVE THREAT
9	simbhaolisugars.in	32	32	ACTIVE THREAT
10	donutclients.st	32	32	ACTIVE THREAT
11	www.simbhaolisugars.in	30	30	ACTIVE THREAT
12	aixcijiax.mcv.kr	27	27	ACTIVE THREAT
13	solar-sanat.net	26	26	ACTIVE THREAT
14	newdc35635.duckdns.org	26	26	ACTIVE THREAT
15	respaldo30000.duckdns.org	26	26	ACTIVE THREAT
16	coolcams.duckdns.org	24	24	ACTIVE THREAT
17	dl.armour-inc-down.net	23	23	ACTIVE THREAT
18	my.com.au.debbiesimril.com	22	22	ACTIVE THREAT
19	banking.bankaustria.at.dswcontracting.work	22	22	ACTIVE THREAT
20	91-92-241-8.cprapid.com	21	21	ACTIVE THREAT
21	bbos.minet.vn	20	20	ACTIVE THREAT
22	mn.34509.su	19	19	ACTIVE THREAT
23	christophercheung.com	19	19	ACTIVE THREAT
24	www.srv892825.hstgr.cloud	19	19	ACTIVE THREAT
25	libss.0x504.com	19	19	ACTIVE THREAT
26	devilnet.xyz	19	19	ACTIVE THREAT
27	teamc2.duckdns.org	18	18	ACTIVE THREAT
28	cms.hoangddt.net	18	18	ACTIVE THREAT
29	beesoft.vn	17	17	ACTIVE THREAT
30	raw.flameblox.com	17	17	ACTIVE THREAT

About Malware Hosting Domains

Malware hosting domains serve as distribution points for malicious software. Attackers use these domains to host payloads that are delivered through phishing emails, drive-by downloads, or exploit kits. Some domains are purpose-built for malware delivery, while others are legitimate services (such as file sharing platforms or compromised websites) being abused by threat actors.

Recommended actions: Block listed domains at your DNS resolver or firewall. Add them to your organization's blocklist. For DNS-level blocking, consider using Pi-hole, pfBlockerNG, or your enterprise DNS security solution. For detailed analysis of any domain, click its name in the table above.

Top Malicious IPs SSH Attacks Botnet C2 IPs How to Block Threats API Access