Aggregated list of compromised websites

More about file formats and API usage? See our FAQ or the compromised lists API →

What is the "Current compromised URLs" list?

URLs flagged by our sources as compromised within the last 24 hours — addresses or site links observed in malicious activity during that window.

What is the "All-time compromised URLs" list?

A historical archive of URLs that have ever appeared in our compromised feed. A URL on this list does not mean the site is still compromised today; most entries reflect past incidents only.

What format are the files in?

Plain text: one URL per line. Downloads are free and do not require an API token.

Can I download compromised domains by zone?

Yes. Besides these global URL feeds, you can pull current compromised domain names for a single TLD — for example .com or .net — from each zone page (download link and chart on the zone). Browse zones here, or use the compromised-zone API.

Where does the data come from?

We collect, normalize, and deduplicate indicators daily from:

• urlhaus.abuse.ch
• hole.cert.pl
• stamparm/blackbook
• romainmarcoux/malicious-domains
• iplists.firehol.org (iblocklist_abuse_zeus.netset)
• iplists.firehol.org (firehol_level1.netset)
• blocklist.de

Looking for compromised IP addresses or TLD abuse statistics instead?