GitHub
Home / Documentation / XARF Sample Reports

Real-world example XARF v4 reports for every abuse type.

XARF Sample Reports

Example XARF v4 reports — one for every category and type in the specification. Use them to see the shape of a valid report, test your parser, or as a starting point for your own generator.

All examples are maintained in the xarf-spec repository and validate against the current v4 schemas.

Anatomy of a report

Every report shares a small core — xarf_version, report_id, timestamp, reporter, source_identifier, and the category/type pair that selects the type-specific fields — plus an evidence array carrying a representative sample (an email, a screenshot, a log excerpt).

Messaging — spam

{
  "xarf_version": "4.2.0",
  "report_id": "02eb480f-8172-431a-9276-c28ba90f694a",
  "timestamp": "2025-01-11T10:59:45Z",
  "reporter": {
    "org": "Example Anti-Spam Service",
    "contact": "[email protected]",
    "domain": "antispam-service.example"
  },
  "sender": {
    "org": "Example Anti-Spam Service",
    "contact": "[email protected]",
    "domain": "antispam-service.example"
  },
  "source_identifier": "192.168.1.100",
  "source_port": 25,
  "category": "messaging",
  "type": "spam",
  "evidence_source": "spamtrap",
  "protocol": "smtp",
  "smtp_from": "[email protected]",
  "subject": "Urgent: Claim Your Prize Now!",
  "evidence": [
    {
      "content_type": "message/rfc822",
      "description": "Complete spam email with headers",
      "payload": "UmVjZWl2ZWQ6IGZyb20gZXhhbXBsZS5jb20gKGV4YW1wbGUuY29tIFsxOTIuMTY4LjEuMTAwXSkKCVN1YmplY3Q6IFVyZ2VudDogQ2xhaW0gWW91ciBQcml6ZSBOb3chCglGcm9tOiBtYXJrZXRpbmdAZXhhbXBsZS5jb20=",
      "hash": "sha256:cee5863cbfe009a2560168a939bbced8d16eebafa97eb34d7b3b9d90f7bf1a17"
    }
  ],
  "tags": [
    "spam:commercial",
    "detection:automated",
    "language:english"
  ]
}

Connection — login attack

{
  "xarf_version": "4.2.0",
  "report_id": "dbf79f17-f4f4-4c22-ae58-19991f52a1e8",
  "timestamp": "2025-01-11T12:17:20Z",
  "reporter": {
    "org": "SSH Honeypot Network",
    "contact": "[email protected]",
    "domain": "ssh-monitor.example"
  },
  "sender": {
    "org": "SSH Honeypot Network",
    "contact": "[email protected]",
    "domain": "ssh-monitor.example"
  },
  "source_identifier": "198.51.100.77",
  "source_port": 45621,
  "category": "connection",
  "type": "login_attack",
  "evidence_source": "honeypot",
  "destination_ip": "203.0.113.22",
  "destination_port": 22,
  "protocol": "tcp",
  "service": "ssh",
  "attempt_count": 2847,
  "successful_logins": 0,
  "duration_minutes": 180,
  "username_patterns": [
    "admin",
    "root",
    "user",
    "test",
    "guest"
  ],
  "password_patterns": [
    "dictionary_attack",
    "common_passwords",
    "numeric_sequences"
  ],
  "attack_pattern": "brute_force",
  "threshold_exceeded": "2025-01-11T08:09:14Z",
  "evidence": [
    {
      "content_type": "text/plain",
      "description": "SSH authentication failure logs showing brute force pattern",
      "payload": "U1NIIGJydXRlIGZvcmNlIGF0dGFjayBkZXRlY3RlZDogMjg0NyBhdHRlbXB0cyBpbiAzIGhvdXJz",
      "hash": "sha256:ef3c219beff759f9e6e1fe8c1d7983ffbad5adf477714d7ec88f7dfa577b3504"
    }
  ],
  "tags": [
    "attack:brute_force",
    "service:ssh",
    "pattern:dictionary"
  ],
  "first_seen": "2025-01-11T06:17:20Z"
}

Content — phishing

{
  "xarf_version": "4.2.0",
  "report_id": "1a5ec293-0849-40a4-9eba-d5926262ff05",
  "timestamp": "2025-01-11T15:15:24Z",
  "reporter": {
    "org": "Brand Protection Service",
    "contact": "[email protected]",
    "domain": "brand-protect.example"
  },
  "sender": {
    "org": "Brand Protection Service",
    "contact": "[email protected]",
    "domain": "brand-protect.example"
  },
  "source_identifier": "203.0.113.45",
  "category": "content",
  "type": "phishing",
  "evidence_source": "automated_scan",
  "url": "http://secure-banking-login.example.com/auth",
  "target_brand": "Major Bank Corp",
  "file_hash": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
  "evidence": [
    {
      "content_type": "image/png",
      "description": "Screenshot of phishing page mimicking bank login",
      "payload": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==",
      "hash": "sha256:6b7fa434f92a8b80aab02d9bf1a12e49ffcae424e4013a1c4f68b67e3d2bbcd0"
    },
    {
      "content_type": "text/html",
      "description": "Source code of phishing page",
      "payload": "PGh0bWw+PGhlYWQ+PHRpdGxlPlNlY3VyZSBCYW5raW5nIExvZ2luPC90aXRsZT48L2hlYWQ+",
      "hash": "sha256:ae9d634a3f01a120303e5e6f83b5308f105bc2de86a97089b47ff11b9494f0f7"
    }
  ],
  "tags": [
    "target:banking",
    "technique:credential_harvesting",
    "severity:high"
  ]
}

Browse all 32 examples

One sample per type, grouped by category. Each links to the source file in the specification repository.

Connection

Content

Copyright

Infrastructure

Messaging

Reputation

Vulnerability

Looking for the machine-readable set? Clone xarf-spec/samples/v4 — 32 JSON files, one per type, all schema-valid.