The Shadowserver team represents some of the most capable and experienced security experts in the world, working quietly behind the scenes to make the Internet more secure for everyone.

Our Story

Since our founding in 2004, The Shadowserver Foundation has become one of the world’s leading resources for Internet security reporting and malicious activity investigation. When we started, we were staffed entirely by volunteers. Today, we employ a full-time team and maintain a global infrastructure spanning 80 countries.

We have never wavered from our original values. Shadowserver has pioneered a radical shift in the international security community, in which governments and major organizations share what they know, so that all parties can become more secure.

Our goal is to drive change, foster collaboration, and contribute to a culture in which our industry delivers ever greater service and capability. Every year, we raise the bar. That commitment is why Shadowserver is so deeply trusted.

Our Mission & Vision

Our mission is to make the Internet more secure by bringing to light vulnerabilities, malicious activity and emerging threats.

We promote a culture of sharing, equip organizations to improve their security, support criminal investigations, help protect victims, and offer free remediation reports.

We’re driven by the vision of a secure, threat-free Internet.

As security professionals, we understand there will always be obstacles on that path. Yet as passionate altruists committed to doing the right thing for the right reasons, we strive to that end: conducting leading-edge research and innovation with transparency, impartiality, and unassailable ethical standards.

How we're funded

Our funding comes entirely from sponsorships, grants, and charitable donations, thanks to individuals and partners like you, who share our vision of a more secure Internet.

Become a sponsor
Europol’s European Cybercrime Centre (EC3) is very pleased to team up with The Shadowserver Foundation to counter cybercrime, as it threatens the safe use of the Internet by people around the globe.
The Shadowserver Foundation Steps Up Cooperation with Europol to Combat Cybercrime
JPCERT Coordination Center is honored to work with The Shadowserver
Foundation. With their advanced technology and thoughtful support, we
are happy to continue working together to create a safer cyber space.
JPCERT Coordination Center
CERT Polska highly values working with The Shadowserver Foundation for
their commitment to making the Internet a safer place, demonstrated in
high quality services and research.
CERT.PL
Trend Micro are very happy to have partnered on investigations with The ShadowServer Foundation in the past, and continue to in future, in our shared goal to make the world safe for the exchange of digital information.
Trend Micro
We have been using Shadowserver’s feeds since 2011 and they have been
one of our most important sources ever since. They greatly increase our
ability to see which threats prevail in our constituency and their well
documented format makes them ideal for enrichment and further distribution.
CERT.AT
The National Cyber Security Centre of The Netherlands is proud to have the privilege to be working with this great group of highly skilled professionals at the Shadowserver foundation for many years and hope to continue this endeavour for many many years to come.
NCSC.NL
Reconnaissance of our own vulnerabilities and weaknesses is essential for improving CERN’s security defences and for raising the bar towards the attackers. While we run our own vulnerability scans against our infrastructure and we team up with many external universities for remote penetration testing, the Shadowserver Foundation provides us with another very important independent and thorough view where we can improve our security posture.
CERN
Shadowserver is one of our primary threat intelligence sources. The
feeds significantly increase our ability to perform our proactive
services and inform our constituents of issues in their networks. It
is an honour to work with the Shadowserver Foundation and together
work towards making the internet a safer place.
CSIRT-CY
The Shadowserver Foundation is the largest feed provider for CERT.LV
enabling us to receive valuable information about threats and
vulnerabilities in the Latvian IP address space. Empowered with this
information CERT.LV is now more capable of protecting its stakeholders.
CERT.LV
The Shadowserver Foundation is one of the most valuable partners of
INCIBE-CERT. For many years they have proved to be a reliable and
trustworthy source of information. Keep it up!
INCIBE CERT.ES
CERT-Bund very much appreciates the awesome and tireless hard work
Shadowserver has been doing to support the international security
community for many years. The daily reports on malware infections and
openly accessible services provided by Shadowserver to national
CSIRTs feature a valuable, high-quality resource of information for
identification of security issues and notification of affected parties.
CERT-Bund/BSI
1.7 billion+

malware samples in our malware repository

4-5 million

IP addresses sinkholed per day, across 400 different malware family variants

848,000

Malicious domains sinkholed & blocked in a single botnet takedown operation, 2.5M over 4 years.