DATASET
COVID-19 Themed Domain Dataset

To assist the information security community, SpyCloud researchers have compiled, enriched, and analyzed a list of over 136,000 hostnames and fully qualified domain names with COVID-19 or coronavirus themes from a variety of open-source feeds.
We have made the dataset available to demonstrate how to complete a low-cost analysis using open-source threat intelligence data.
Disclaimer: This data is provided as-is, with no guarantees that the data will be accurate or maintained in any way. For more information about the sources, please refer to the original open-source feeds.
Source | Description |
Certificate Transparency logs | Open dataset for exploring SSL Certificates to identify potential abusive hostnames. |
Risk IQ’s COVID-19 feed | Public feed of COVID-19 themed domains sponsored by Risk IQ. |
Domain Tools’ COVID-19 threat list | Public feed of COVID-19 themed domains sponsored by DomainTools. |
Rapid7 Project Sonar | Open data of internet-wide surveys conducted by Rapid7 Labs. |
Please note that we only used the hostnames from these sources; additional metadata was collected by SpyCloud researchers.
Download the Dataset
Domains with COVID-19 and Coronavirus Themes
Related Resources

2022 Report: Identity Exposure of London’s FTSE 100
Our annual analysis of exposed credentials and PII tied to London’s FTSE 100 employees uncovered insights about password reuse and malware-infected devices that put these organisations and the companies that rely on them at risk.

2022 Fortune 1000 Identity Exposure Report
Our annual analysis of data tied to Fortune 1000 companies includes insights on credential exposure, password reuse rates, and the impact of malware-infected employees and consumers.

The CISOs Report: Perspectives, Challenges and Plans for 2022 and Beyond
Read key insights from CISOs on the challenges facing organizations, including compromised identities, ransomware attempts, and implementation of Zero Trust Models.
With SpyCloud, you get enterprise-level, automated account takeover and ransomware prevention powered by Cybercrime Analytics based on actionable darknet insights.
SpyCloud offers the largest collection of recaptured darknet data in the world, combined with the earliest possible recovery. Our proprietary engine quickly ingests data from breaches, malware-infected devices, and other underground sources, then cleanses and enriches the data – adding context to the records so you understand the severity of the exposures (the source, breach description, and the actual password in plaintext). Our customers get notifications of compromised accounts and passwords far sooner with SpyCloud than any other provider.
Assets
Total
Passwords
Email
Addresses
Data Types
Check Your Exposure
See your real-time account takeover exposure details powered by SpyCloud data.