The Shadowserver Foundation is a nonprofit security organization working altruistically behind the scenes to make the Internet more secure for everyone. Our Story

What We Do

We collect vast amounts of threat data, send tens of thousands of free daily remediation reports, and cultivate strong reciprocal relationships with network providers, national governments and law enforcement. We bring malicious activities and abusable vulnerabilities out of the shadows, expedite their remediation and help to better secure the Internet. Find Out More
4-5 million

IP addresses sinkholed per day, across 400 different malware family variants

70 billion

SSL certificates, indexed
 & searchable in our data & analysis clusters

3.7 billion

IPv4 addresses scanned on 148 ports each per day (1.07 billion IPv6 on 77 ports). 381 million hosts respond

Who We Serve

National CSIRTs

We give CSIRTs the vantage point to understand the big picture of what’s happening on the networks they’re responsible for.

Industry Sectors

We work with business and tech firms, financial institutions and academia, to improve network security, enhance product capability, and advance threat research.

Law Enforcement

We partner with law enforcement to help protect victims, take down global cybercrime infrastructures and prevent attacks before they occur.

News & Insights

  • Shadowserver 2024: Highlights of the Year in Review

    February 17, 2025
    A review of Shadowserver’s 20th year as the world’s largest provider of free, timely, actionable, daily cyber threat intelligence. Covering the latest improvements in our public benefit services, responses to emerging cyber threats, and detection and reporting of the latest vulnerabilities to National CSIRTs and system defenders globally. We provide highlights of our cybersecurity capacity building efforts, plus successful outcomes from our free support to Law Enforcement in major cybercrime disruption operations.
  • Non-profit consortium launches national scale Cyber Resilience pilot to assess the cyber threat landscape for the NGO sector in The Netherlands

    April 4, 2024
    A non-profit consortium – consisting of The Hague Humanity Hub, the CyberPeace Institute (CPI), Connect2 Trust Foundation and The Shadowserver Foundation, co-funded by Rijksdienst voor Ondernemend Nederland (RVO), will produce a national level assessment of the cyber threat landscape for NGOs, while measuring the impact and harm of cyber threats on the sector.
  • Introducing Report Severity Levels

    October 12, 2023
    To make it easier for organizations to consume and prioritize on our daily reports we are introducing report and event severity levels. Each report type and event in the report will have a severity level assigned. This will make it possible to filter all our daily reporting based on the severity of the actual event being reported.

Shadowserver uses cookies to gather analytics. This allows us to measure how the site is used and improve the experience for our users. For more information about cookies and how Shadowserver uses them, see our privacy policy. We need your consent to use cookies in this way on your device.