Popular topics: Spam blocklist Abuse Contact ValidationPolicy blocklistWelcome listPotentially compromised accountsCombined blocklistDomain blocklistExploit blocklistRspamdWhat is XARF?

File attachments stream


The File Stream is a real-time corpus of files, derived from a 100% spam, the target-rich environment may be used to address both real-time short tail antispam zero-day filtering and long-tail antivirus botnet, command, and control as well as malware code research.

You decide whether spam messages for heuristics, zero-day edge filtering using our MD5 hashed files, or detonating raw files in sandboxes to hunt botnets, command and control servers, or malware code analysis is more important to your security focus.

This feed is a must-have, to complete the suite of feeds you use to filter, hunt, learn and adapt in real-time.


Anti-virus vendors need to gain access to the latest malicious email-borne payloads to the sandbox, detonate and find command and control servers and also analyze malicious code. If you hunt, this feed is a must-have, to complete the suite feeds you use to hunt.

Key Benefits

  • Command and Control server hunters are able to detonate as many files as possible in sandboxes, to track down botnet command and control servers and their proxies.
  • Antivirus researchers find new malicious code in malware, ms-script, and pdf script variants. Ask for our file feed.



File feeds may be sent in RAW or JSON format.

JSON Payload Format Example

  "smtp_mail_from": "[email protected]",
  "content_type": "application/pdf",
  "source_ip": "",
  "data_origin": "com.abusix.spam.blackhole",
  "smtp_timestamp": "Tue, 14 May 2019 14:02:02 +0000",
  "source_ip_rir": "ripe",
  "source_port": "60299",
  "smtp_rcpt_to": [
    "[email protected]"
  "source_ip_country_iso": "GB",
  "attachment_base64_encoded": "JVBERi0x[...]"

If you have questions, please contact our support.

Volume (as of June 16, 2020)

Abusix processes an ever-increasing 800 million trap hits daily through its infrastructure. Statistics below, are for deduped data, as of June 16, 2020.

Raw Spam Files
Includes ALL URLs in the BLACK+GREY message stream and more (deduped over 60 mins)

min: 89.7K / day
max: 357.7K / day
avg: 268.1K / day
images avg: 110k / day
text avg: 81k / day
pdfs avg: 70k / day
archive avg: 9k / day
word avg: 6k / day
executable avg: 5k / day
excel avg: 4k / day
web avg: 3k / day
message avg: 2k / day
audio avg: 400 / day
video avg: 250 / day
powerpoint avg: 250 / day


Understanding of how to curl a live stream of data

Was this article helpful?

Can’t find what you’re looking for?

Our award-winning customer care team is here for you.

Contact Support