Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: SANS Internet Storm Center SANS Internet Storm Center

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Latest Diaries

Covid19 Domain Classifier

Published: 2020-03-28
Last Updated: 2020-03-28 11:16:07 UTC
by Didier Stevens (Version: 1)
1 comment(s)

Johannes started a Covid19 Domain Classifier here on our Internet Storm Center site.

From SANS NewsBites Vol. 22 Num. 025:

Help Us Classify COVID-19 Related Domains

These last couple of weeks, criminals have been using COVID-19 for everything from selling fake cures to phishing. Every day, several thousand domains are registered for COVID-19 related keywords. We are trying to identify the worst, and classify the domains into different risk categories. If you have some time this weekend, please help us out by checking out some of these domains. To participate, see The domain data is based on a feed provided by Domaintools and we will make the results of this effort public for download as soon as we have a “critical mass” of responses.

When you log in with your account to the SANS ISC site, you'll get a list of 10 domains to classify, like this:


Didier Stevens
Senior handler
Microsoft MVP

Keywords: covid19 domains
1 comment(s)

If you have more information or corrections regarding our diary, please share.

Recent Diaries

Malicious JavaScript Dropping Payload in the Registry
Mar 27th 2020
1 day ago by Xme (0 comments)

Very Large Sample as Evasion Technique?
Mar 26th 2020
2 days ago by Xme (0 comments)

Recent Dridex activity
Mar 25th 2020
3 days ago by Brad (0 comments)

Another Critical COVID-19 Shortage: Digital Security
Mar 24th 2020
4 days ago by Russ McRee (0 comments)

Windows Zeroday Actively Exploited: Type 1 Font Parsing Remote Code Execution Vulnerability
Mar 24th 2020
4 days ago by DidierStevens (0 comments)

KPOT Deployed via AutoIt Script
Mar 23rd 2020
4 days ago by DidierStevens (0 comments)

More COVID-19 Themed Malware
Mar 22nd 2020
5 days ago by DidierStevens (0 comments)

Honeypot - Scanning and Targeting Devices & Services
Mar 21st 2020
6 days ago by Guy (0 comments)

View All Diaries →

Latest Discussions
created Mar 10th 2020
2 weeks ago by Bill (2 replies)

DShield analysis
created Mar 1st 2020
3 weeks ago by Anonymous (0 replies)

Setting up a security champions network.
created Feb 24th 2020
1 month ago by Anonymous (0 replies)

Wireshark - To analyze "TCP sequence numbers" or not to analyze.
created Feb 15th 2020
1 month ago by Anonymous (0 replies)

TikTok app possibly using DNS over HTTPS directly
created Feb 15th 2020
1 month ago by jauntysankey (0 replies)

View All Forums →

Latest News

Top Diaries

An infection from Rig exploit kit
Jun 17th 2019
9 months ago by Brad (0 comments)

Malspam with password-protected Word docs pushing Dridex
Jun 18th 2019
9 months ago by Brad (0 comments)

Wide-scale Petya variant ransomware attack noted
Jun 27th 2017
2 years ago by Brad (0 comments)

Using a Raspberry Pi honeypot to contribute data to DShield/ISC
Aug 3rd 2017
2 years ago by Johannes (0 comments)

Verifying Running Processes against VirusTotal - Domain-Wide
Jun 28th 2019
8 months ago by Rob VandenBrink (0 comments)