whackWhat we contribute back
We take from the public threat-intelligence commons every day. Taking without giving back is freeloading, so what we confirm, we publish — where it becomes blocking for everyone, not just for us.
Where confirmed findings go
| Destination | What we send |
|---|---|
| MalwareBazaar | Malware samples captured during a scan |
| VirusTotal | Malware samples captured during a scan |
| AlienVault OTX | Indicators, as a rolling public pulse |
| URLhaus | URLs confirmed to be distributing malware |
| ThreatFox | Malicious URLs, with family attribution where we have it |
| Netcraft | Confirmed phishing pages, for takedown and browser blocking |
Our submission history is public under the account whack_sh — the abuse.ch profile covers every one of their platforms, and the MalwareBazaar record lists the samples themselves with dates. That is the check that matters: it is their record of what we sent, not ours.
We do not hand a feed its own data back
A large share of the URLs we scan arrived from a public feed in the first place. Submitting those back to the same organisation would inflate their database with their own records and make our contribution look bigger than it is. So we track which source each URL came from and never submit it to that source. What we contribute is what we found.
Malware samples are never redistributed
Captured samples go to malware-research platforms built to receive them, and nowhere else. They are never downloadable from whack.sh — not from a report, not from the API, not by any URL. We are a scanner, not a malware repository.
Your scans, your call
If a URL you scan turns out to be distributing malware or hosting a phishing page, we may contribute that URL. This is on by default, and you can turn it off in your account settings at any time.
What travels is the URL and the malware family. Your account, your identity, and everything else you have scanned do not. URLs we cannot confirm are never shared, and neither is anything from a scan we merely found suspicious — only confirmed findings leave.
One honest limitation: contributions are public the moment they are made. Turning sharing off stops future submissions, but nothing already published can be recalled.
Flagged in error?
Request a re-review. If we submitted something wrongly, we will say so to the receiving service, not just quietly stop.