Statistics
Top Malware
Dridex
Blacklisted SSL Certificates
3'546
Top issuing CA
Let's Encrypt Authority X3
Blacklisted JA3 Fingerprints
98
Distinct Malware Families
95
Top issuing CAs
The table below documents the top ten Certificate Authorities (CA) that are issuing the most SSL certificates for botnet C&Cs. Please note that the statistic blow also includes self-signed certificates.
| Rank | Certificate Authority (CA) | SSL certificates |
|---|---|---|
| 1 | Let's Encrypt Authority X3 | 415 |
| 2 | C=US, ST=Denial, L=Springfield, O=Dis | 228 |
| 3 | localhost | 215 |
| 4 | C=XX, L=Default City, O=Default Company Ltd | 199 |
| 5 | example.com | 152 |
| 6 | AsyncRAT Server | 142 |
| 7 | C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | 140 |
| 8 | * | 111 |
| 9 | localhost, C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | 105 |
| 10 | Orcus Server | 54 |
Top SSL Certificate Common-Names (CN)
The table below documents the top ten common-names (CN) used by botnet C&Cs.
| Rank | Common-Nanme | SSL certificates |
|---|---|---|
| 1 | C=US, ST=Denial, L=Springfield, O=Dis | 228 |
| 2 | localhost | 215 |
| 3 | C=XX, L=Default City, O=Default Company Ltd | 199 |
| 4 | example.com | 152 |
| 5 | AsyncRAT Server | 142 |
| 6 | C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | 140 |
| 7 | * | 111 |
| 8 | localhost, C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | 105 |
| 9 | Orcus Server | 54 |
| 10 | domain.com/O=My Company Name LTD./C=US | 54 |
Top Listing Reasons
The table below shows the listing reasons for blacklisted SSL certificates on SSLBL.
| Rank | Listing reason | SSL certificates |
|---|---|---|
| 1 | Dridex C&C | 735 |
| 2 | Gozi C&C | 295 |
| 3 | Quakbot C&C | 292 |
| 4 | TorrentLocker C&C | 271 |
| 5 | KINS C&C | 241 |
| 6 | Gootkit C&C | 233 |
| 7 | Malware C&C | 216 |
| 8 | AsyncRAT C&C | 161 |
| 9 | IcedId C&C | 146 |
| 10 | PandaZeuS C&C | 139 |
| 11 | TrickBot C&C | 137 |
| 12 | OrcusRAT C&C | 79 |
| 13 | QNodeService C&C | 61 |
| 14 | Shylock C&C | 45 |
| 15 | Adwind C&C | 43 |
| 16 | Vawtrak C&C | 33 |
| 17 | ZLoader C&C | 29 |
| 18 | Qadars C&C | 26 |
| 19 | Ransomware C&C | 25 |
| 20 | TA505 C&C | 24 |