Threat intelligence
Where our malware signatures come from, how often they move, and — the part most vendors leave out — what they cannot tell you.
5,40,354
known-bad file hashes in the database
Last successful update 13 Oct 2026, 1:30 pm IST
What this database can and cannot answer
It answers “do we know this hash” — not “is this file safe”. The two are not the same question, and the difference matters most in the case you care about.
A hash we do not hold means only that: absent from our table. It is not a clean bill of health. Malware written yesterday, or recompiled to change a single byte, has a hash nobody has seen — and no signature database in the world, ours included, will recognise it.
Signature matching is one layer. We publish what it is worth rather than implying it is everything.
Where the signatures come from
Two ClamAV signature databases, main.cvd and daily.cvd, published by Cisco Talos. We read the hash members out of them and serve those hashes from our own API.
The figures below were measured on 21 September 2026 against main.cvd version 63 and daily.cvd version 28130 — named, so the measurement can be repeated.
- MD5 hashes
- 541,759
- SHA-256 hashes
- 187
- SHA-1 hashes, dropped
- 3
- False-positive corrections applied
- 998
- Signature names withdrawn upstream
- 22
- Windows-family signatures
- 268,476
541,949 hash signatures became 541,925 rows once withdrawn names and the three SHA-1 entries were dropped, and 540,335 once duplicates between the two databases collapsed onto the same hash — as measured on 21 September 2026, against the database versions named above. The figure at the top of this page is today’s, read live.
Why ClamAV and not a larger feed
MalwareBazaar carries roughly 1.14 million SHA-256 hashes — more than twice what we hold — and would have been the obvious choice. We do not use it, for a reason worth stating plainly: we are not licensed to.
abuse.ch’s terms, effective 4 November 2025, reserve commercial use to a paid Spamhaus subscription (§4), restrict access to not-for-profit purposes (§3.1), and prohibit derivative works and bulk harvesting (§7.3). This is a product we sell. Using that feed anyway would mean building a security company on a licence breach.
The ClamAV databases ship a GPLv2 COPYING file inside the archive itself, and GPLv2 permits commercial use. The hashes are only ever served from our API and are never bundled into the desktop installer, so no copyleft distribution obligation is triggered.
What we deliberately leave out
ClamAV also publishes PUA signatures — potentially unwanted applications. We do not ingest them, and ClamAV itself only loads them when an operator opts in.
They cover Radmin, VNC, IP scanners and similar: ordinary sysadmin tools. Ingesting them would have this product tell a customer that their remote desktop software is a high-severity trojan. The cost of leaving them out is about 40 rows out of 540,000; the cost of including them would be paid by every user who does their own IT.
How often it updates, and how we know it still is
The ingest runs hourly. It first asks a DNS TXT record which database versions are current, and downloads nothing when we already hold them — so a normal hourly tick costs one DNS lookup rather than 107 MB.
A second, separate job checks daily at 09:00 that the feed is still arriving, and exits non-zero when it is not. It is separate on purpose: an ingest that never runs cannot report that it never ran, and “silently stopped” is the dangerous failure for a security product — every screen stays green while the database quietly ages.
That check is the same source as the timestamp at the top of this page. If the feed stalls, the date up there stops moving, in public.