MailThreatZero Beta

Threat intelligence

Global Email & Malware Threat Intelligence

Explore reported spam sources and malicious infrastructure around the world.

Beta

Three sources feed this map — this platform's own gateway observations, which are our detections rather than somebody else's feed; the Tor Project's exit list, which is public infrastructure rather than an accusation; and Phishing.Database's list of addresses hosting phishing pages, published under the MIT License. Both are named below with what they cover, and the source panel on the map itself is the live statement of which ones are on right now. Several better-known feeds stay switched off because their own terms do not let a commercial site republish them, and each of those reasons is quoted below rather than summarized as "licensing". A filter that selects nothing still says so instead of drawing zeros.

The map

What this map holds, and when it stays blank

Two sources fill it. The first is this platform's own gateway: sending addresses that our filters scored as abusive — refused at the door, held in quarantine, caught by a honeypot address, or delivered with a score high enough to be held on most domains — aggregated to one row per address. That layer is first party. It is our detections, not a report somebody else published, and it covers addresses that sent mail to this gateway, so its totals describe what this gateway observed rather than the whole internet. The second is the Tor Project's exit list, published under a CC0 no-copyright waiver and refreshed every six hours. A Tor exit relay is public infrastructure run by volunteers and most traffic leaving one is ordinary, so that layer is labeled as infrastructure and is never counted as abuse. The third is Phishing.Database, under the MIT License: addresses hosting phishing pages, drawn as their own layer and only while the project's snapshot is under three days old.

Better-known feeds stay off, and the reason is always their own terms rather than effort: the abuse.ch projects grant access to authenticated users for "not-for-profit purposes" and require a subscription for commercial use; Spamhaus offers DROP "free of charge to anyone who wants to add this layer of protection", which grants use and not publication; DShield states CC BY-NC-SA 4.0, which is NonCommercial. The section on sources below names each one.

If you are reading this notice with the map absent, the selection above has nothing in it, or a window is being withheld because coverage does not span it — which is what the historical "recently reported" view does until enough history has accumulated, and why the map opens on "currently listed" instead. Neither case is drawn as a world outline with zeros on it, and no screenshot of numbers from somewhere else is ever substituted. An empty map that says it is empty is information; a map with invented data on it is not.

The controls, the legend, the totals and the country table stay visible either way, because what can be filtered and why an option is closed to you is itself worth reading. Every figure they hold comes from the published aggregate or is shown as a dash.

How to read it

Five things have to be said before anybody looks at a country shaded darker than its neighbors, because every one of them is a way a map like this gets misread:

  • Locations reflect observed infrastructure, not the people responsible. An address in a country means a machine was reported there. It says nothing about who rented it, who is operating it, or where they are. Most of this infrastructure is compromised or rented by someone who is somewhere else.
  • Coverage varies by source. Each source watches what it watches, in the regions and formats it watches them in. A country that looks quiet may be quiet, or may be somewhere no enabled source reports from. The map cannot tell those apart, so neither should you.
  • These indicators do not represent global email volume. Nothing here is a measurement of how much mail any country sends, or how much of it is spam. It is a count of reported infrastructure, which is a different quantity entirely.
  • One layer is ours, and it says so. The gateway layer is MailThreatZero's own filters' verdicts on addresses that sent mail to this gateway, and the map marks it first party so it can never be read as an outside organization's corroboration of us, or the reverse. What has not changed is what may leave the platform to say it. One row per sending address and threat category, with when it was first and last seen and how many messages it accounts for. No recipient, no sender address, no subject, no domain, no tenant and no message id: the published table has no column that could hold any of them, so a map built from mail is incapable of naming whose mail it was rather than merely careful about it.
  • A lookup answer is not our observation. Addresses this gateway refused purely because a public reputation zone said so are left out of the gateway layer on purpose. Publishing the set of addresses somebody else's zone told us to refuse would be republishing their list with our name on it, which is both a licensing problem and a false claim of detection. The gateway layer is built from what our own scanners scored, and a message whose only positive signal was a reputation lookup is skipped and counted as skipped.

What the number means

One metric, defined once so that nothing downstream can quietly redefine it:

Unique reported infrastructure IPs — the number of distinct public IP addresses attributed to a country within a time window, counted once across every source that is both enabled and permitted to be displayed.

Four consequences follow from that sentence, and each one is a mistake it prevents:

  • Several indicators may reference one address. Sources report different things: one reports indicators of compromise, another reports URLs. Twenty reported URLs on one host are one address on this map, not twenty. Adding a URL count to an address count does not produce a quantity at all, and it is the easiest possible way to publish a figure that is wrong by a factor of three.
  • One address is not one villain. Shared hosting is the normal case. A single address can carry a company's website, somebody's mail server and a malicious path at the same time, and the report is about the path rather than about the machine or its other tenants.
  • Category totals overlap and need not sum. One address can be a botnet controller and a malware host at once. Each category count is correct on its own and their sum is larger than the combined total — so a stacked chart built on the assumption that they add up would be wrong, and nobody would notice.
  • Public addresses only. Private, loopback, link-local, multicast, reserved and carrier-NAT ranges are refused before they are stored. A public map plotting a private range is leaking somebody's internal layout, and one plotting a carrier's NAT pool is plotting a carrier rather than an attacker.

An address that no geolocation database can place is counted as unmapped and reported as such, rather than being dropped. Silently discarding it would make the total quietly smaller than reality with nothing anywhere saying so.

The layers, kept separate

The layers are labeled separately because they are different claims, and a single merged "threats" number would hide which one an address belongs to. A category is taken from each individual record, never assumed from the name of the feed it arrived in, and a threat type the system does not know is counted as unmapped rather than guessed at. The filter above the map is built from what the published aggregate reports rather than from a list written into this page, so a layer that exists in the data is always selectable — a hand-kept list is how a layer becomes invisible while looking fine.

Spam sources

Gateway layer, first party

Addresses that sent mail this platform's own filters scored as spam — held, refused, or delivered with a score high enough to be quarantined on most domains. It is filled from our own scanners, because the one external publisher of this layer grants use rather than publication. Nothing from another feed is ever relabeled as spam to pad it.

Phishing senders

Gateway layer, first party

Addresses whose mail our phishing and brand-impersonation stages named as credential theft. The category comes from the stage that fired, not from the disposition: a quarantine records that a score crossed a line, which on its own would label a credential phish as spam.

Phishing hosting

Third-party feed, MIT License

Addresses where Phishing.Database found a phishing page still being served: mostly rented cloud and web hosting. These machines hosted the page; they did not send the mail, so this layer is kept apart from phishing senders and the two are never added together. Each address is dated by the project's own snapshot, and a snapshot more than three days old is not drawn, so the layer shows only a current list.

Malware hosting

Gateway layer, first party

Addresses reported as serving or sending a malicious payload — the file at the end of a link, or the attachment a malware verdict was reached on here. Two external feeds also cover this layer and both are switched off on the terms quoted below, so what is drawn today is what our own scanners saw.

Tor exit nodes

Public infrastructure, not abuse

Addresses the Tor Project publishes as exit relays. This is not an accusation. An exit relay is public infrastructure run by volunteers and most traffic leaving one is ordinary mail, browsing and research. It has its own layer precisely so it cannot be folded into an abuse total: the only claim the data supports is that an exit was published at that address, which is useful if you are deciding how to treat exit traffic and misleading as anything else. The list carries addresses only — no ports, no relay names, nothing that identifies an operator.

Command-and-control

No source

Addresses reported as the place already-infected machines report back to. This gateway sees mail, not implant traffic, so this layer needs an external source; the feeds that can are the abuse.ch projects, which are off for the licensing reason quoted below. Nothing here is relabeled to stand in for it, so the layer is simply not among the ones the map offers today.

Exploit, scanning, other abuse

No source

The API validates a longer vocabulary than the layers drawn today, and these are the rest of it. You will not see them in the filter, because the filter is built from the layers the published aggregate reports rather than from a list written into this page: the day a source reports one of them, it appears in the control on its own, and while nothing reports it there is no dead button to press.

How this map works

  1. One source is not fetched at all. The gateway layer is a query over this platform's own mail records, aggregated to one row per sending address and category before anything is stored, and no request leaves the building to produce it. It is listed first because it is the layer a reader is most likely to mistake for somebody else's feed.
  2. External sources are read, not crawled. Records are fetched from each source's published interface. Nothing fetches a malicious URL, resolves it for content, follows a redirect or downloads a sample. A reported URL stays a string. The one outbound lookup that touches an indicator's own infrastructure is a DNS resolution, which is paced, timestamped, and recorded as current hosting rather than as historical origin.
  3. Records are normalized and rejected loudly. Malformed rows are the normal case at this scale, so rejections are counted with their reasons. A feed that silently halves itself looks exactly like a quiet feed, and the count is what tells a schema change apart from a slow day.
  4. Addresses are placed by country using a GeoIP database, and each address is attributed to one country — the one given by the most recent record mentioning it. Without that rule, two sources disagreeing would put one address in two countries and the per-country numbers would stop summing to the total.
  5. Two questions are answered separately. "Who was reported during this window" is a historical statement and never changes retroactively. "Who is on a list right now" changes as records expire or stop appearing in a source's latest snapshot — which is how a delisting is detected at all, because most sources do not send removals, they simply stop including the record. Publishing only one of those would overstate the present or erase the past. The map opens on the second question, because the first one can only be answered for a window the collected history actually spans: a source switched on this morning cannot support a statement about the last thirty days, and rather than answer it short the map withholds that view and prints the date its coverage begins.
  6. Aggregates are replaced atomically. A visitor reads either the previous complete set or the new one, never a half-built map.

A source can be enabled only if it is permitted to be enabled. Where the terms do not establish a right to redistribute, the connector refuses to fetch rather than leaving the decision to whoever clicks the toggle.

Sources and attribution

Named, so that anybody can check what each one publishes and on what terms, and so that no number here reads as ours when it is theirs — or as somebody else's when it is ours. Three are on. The rest are off, and in every case the reason is the terms the publisher sets, read on the page that serves the data:

Shown

  • MailThreatZero gateway — first party, and the only source here that is ours. Sending addresses our filters scored as abusive, aggregated per address into the spam-source, phishing and malware-hosting layers. Its scope is this gateway's own traffic: an address reaches it only by sending mail here, so its totals are this gateway's view rather than a census. Addresses refused solely on a public reputation zone's answer are excluded, because that would republish somebody else's list under our name. See methodology for how a message is scored in the first place.
  • Tor Project exit list — the addresses of Tor exit relays, refreshed every six hours into the Tor exit layer. Shown because the Tor Project waives copyright rather than licensing it: "Data on this site is freely available under a CC0 no copyright declaration." A waiver has no conditions to satisfy, which is what makes it publishable here when richer feeds are not. Remember what an exit relay is: volunteer-run public infrastructure, most of whose traffic is ordinary. About the data (opens in a new tab).
  • Phishing.Database — addresses hosting active phishing pages, retested by the project's PyFunceble suite, into the phishing-hosting layer. Published under the MIT License, which permits use, publication and distribution with its notice kept: Copyright (c) 2018-2025 Mitchell Krog and Nissar Chababy. Records carry the project's own snapshot date, and a snapshot older than three days is not imported, so the source panel shows it as stale whenever upstream pauses. Project and license (opens in a new tab).

Off, and why

  • ThreatFox and URLhaus, abuse.ch projects, along with Feodo Tracker from the same project — indicators of compromise, malware-distribution URLs and botnet controllers. Their shared Terms of Use, effective 2025-11-04, grant access to authenticated users for "not-for-profit purposes" and require a subscription for commercial use. This site sells a product, so switching these on needs both an account credential and a commercial arrangement. Older pages of theirs read more permissively; where two of a publisher's own documents disagree, the permissive one is not the one to rely on. Terms of use (opens in a new tab), ThreatFox API (opens in a new tab), URLhaus API (opens in a new tab).
  • Spamhaus — of the DROP list they say they provide "access to anyone who wants to add this layer of protection, free of charge". That is a grant to use it for protection, which this gateway does; it is not a grant to publish it, which this map would. A right to query a reputation zone is also not a right to the bulk list behind it, so the connector declines to fetch rather than leaving the distinction to whoever clicks a toggle. The DROP list (opens in a new tab), usage terms (opens in a new tab).
  • SANS Internet Storm Center / DShield — states its license outright as CC BY-NC-SA 4.0. NonCommercial excludes this site, and a license that says so plainly is the easiest of these to respect. API and license (opens in a new tab).
  • blocklist.de, CINS Army and the Emerging Threats compromised-address list — all three answer a request without a credential, and none states a license on the page that serves the data. Unstated is not permissive: an open door is not permission to republish, so these stay off until somebody publishes terms that say otherwise.

Each of those refusals is enforced in the connector rather than left to configuration: a source whose access has not been established declines to fetch even when it is switched on, so no click can make this platform publish somebody's data on the strength of a toggle.

Country outlines are drawn from Natural Earth 1:110m admin-0 countries, which is in the public domain, packaged as world-atlas (opens in a new tab) 2.0.2 (ISC, Copyright 2013–2019 Michael Bostock) and joined to ISO 3166-1 alpha-2 codes from the iso-codes (opens in a new tab) project (LGPL-2.1+). The outlines are converted once, ahead of time, and served from this site: no map tile service is contacted when you load this page, so nothing here reports your visit to a third party. The projection is Equal Earth, which is equal-area — on a Mercator world a shaded country's apparent size would be an accident of its latitude rather than anything about the data.

This product includes GeoLite2 data created by MaxMind, available from maxmind.com (opens in a new tab). Country placement follows that database and is approximate at country level.

Questions

Questions people ask first

Why does the map look blank for my selection?

Because that selection genuinely has nothing in it, or because the time window you picked is wider than the coverage behind it, in which case the country breakdown is withheld rather than served short — a thirty-day figure drawn from a few hours of data is indistinguishable from a quiet month. That second case is the usual one just after a source is switched on, and it is why the historical "recently reported" view can be empty while the "currently listed" view the map opens on is full. The notice at the map says which applies, in the API's own words and with the date coverage begins. Switching back to the default view, or clearing the layer filter, is usually enough.

Does this show what your filters caught?

One layer does, and it is labeled. The gateway layer is sending addresses this platform's own filters scored as abusive, aggregated per address; the Tor exit layer is not ours at all. That distinction is carried in the data rather than in prose, so the map can mark our layer first party wherever it appears. What never leaves is the mail itself: no recipient, sender address, subject, domain, tenant or message id has a column in the published table, and the layer is built from our scanners' verdicts rather than from addresses a reputation zone told us to refuse.

Does a Tor exit relay on the map mean something bad?

No. An exit relay is public infrastructure that volunteers run, and most traffic leaving one is ordinary. It is drawn because knowing where exits sit is useful when you decide how to treat exit traffic, and it is kept in its own layer so it can never be added into an abuse total. The Tor Project publishes the list under a CC0 waiver, which is why this is the one external layer here that needs nobody's agreement to display.

Does a dark country mean the attackers are there?

No. It means machines reported by a source were placed there. The infrastructure is usually rented or compromised, and whoever is using it can be anywhere. A map of infrastructure is not a map of people.

Why do the category counts add up to more than the total?

Because one address can be in two categories at once — a controller and a payload host, for instance. Each category count is correct; the total counts each address once. They are not meant to sum.

Is an address on this map dangerous?

It was reported for something specific, usually a single path or file on a machine that may be shared with entirely legitimate services. Treat it as a report about that indicator, not as a verdict on the address or on whoever else is hosted at it.

Why are the well-known feeds missing?

Their terms, quoted in the sources section above. The abuse.ch projects require an authenticated account for not-for-profit use and a subscription for commercial use; Spamhaus grants use of DROP for protection rather than publication; DShield is NonCommercial. Where no license is stated at all, we treat that as no permission rather than as permission. The connectors enforce those refusals themselves, so none of them can be switched on by accident.

Can I use the data?

The sources set those terms, not us, and they are named above with links so you can read them directly. We publish an aggregate view of what each source permits to be displayed, and nothing beyond it. The gateway layer is the one whose terms are ours to set, and what is published of it is deliberately limited to counts per country.

Following it

The beta application has the threat intelligence map as one of its options, and carries the mutual beta NDA. Applying is how you get told when a layer is added or a source is switched on, rather than having to reload a page to find out.

If what you actually need is what happens to your own mail, that is a different question with a real answer today: see features and attachment sandboxing.

Apply for the beta Check feature status