A standard product of the anti-virus community is their black-lists of known malware sites. Recorded Future has taken a new approach to discovering such sites that relies on web-chatter, investigating 70,000 distinct addresses. Almost 10% of this group were found to be associated with at least one type of malware; but here is the surprise - almost none of the sites were on existing malware black-lists. Of the 67,563 sites found to host a single malware, 91% were "new" addresses, and of a far smaller subset of 1,521 sites that were home to two or more types of malware 1,384 (98%) were previously undetected IP addresses. Good work.
A standard product of the anti-virus community is their black-lists of known malware sites. Recorded Future has taken a new approach to discovering such sites that relies on web-chatter, investigating 70,000 distinct addresses. Almost 10% of this group were found to be associated with at least one type of malware; but here is the surprise - almost none of the sites were on existing malware black-lists. Of the 67,563 sites found to host a single malware, 98% were "new" addresses, and of a far smaller subset of 1,521 sites that were home to two or more types of malware 1,384 (91%) were previously undetected IP addresses. Good work.