Skip to main content


COVID-19 Themed Domain Dataset

Graph of new domains related to COVID-19 registered from December 1, 2019 through March 27, 2020

To assist the information security community, SpyCloud researchers have compiled, enriched, and analyzed a list of over 136,000 hostnames and fully qualified domain names with COVID-19 or coronavirus themes from a variety of open-source feeds.

We have made the dataset available to demonstrate how to complete a low-cost analysis using open-source threat intelligence data.

Disclaimer: This data is provided as-is, with no guarantees that the data will be accurate or maintained in any way. For more information about the sources, please refer to the original open-source feeds.

Certificate Transparency logsOpen dataset for exploring SSL Certificates to identify potential abusive hostnames.
Risk IQ’s COVID-19 feedPublic feed of COVID-19 themed domains sponsored by Risk IQ.
Domain Tools’ COVID-19 threat listPublic feed of COVID-19 themed domains sponsored by DomainTools.
Rapid7 Project SonarOpen data of internet-wide surveys conducted by Rapid7 Labs.


Please note that we only used the hostnames from these sources; additional metadata was collected by SpyCloud researchers.

Download the Dataset

Domains with COVID-19 and Coronavirus Themes

A few of our happy customers:

Related Resources

2022 SpyCloud Identity Exposure Report

2022 Annual Identity Exposure Report

Our annual reports analyzes the 15.5 billion assets we recaptured from the criminal underground last year, and how enterprises can use this information to protect themselves from ATO, malware, and ransomware, and protect their consumers from online fraud.

Read More

The SpyCloud Difference

Truly Actionable Recaptured Data

SpyCloud solutions are backed by the world’s most current and comprehensive repository of recaptured data from breaches, malware infections, and other underground sources – with billions of exposed credentials and PII. It’s the same data that fraudsters use, but we make it actionable to prevent account takeover, ransomware attacks, and online fraud.


Check Your Exposure

See your real-time breach exposure details powered by SpyCloud data.