malware-intel
MalwareBazaar (abuse.ch)
A free malware-sample repository from abuse.ch, holding millions of samples searchable by hash, tag or malware signature. Queries go through its API, which now requires a free abuse.ch Auth-Key (one key covers their related services). Use it when you have a suspicious file's hash and want to know whether it is a catalogued sample, or need the sample itself for analysis.
Why it’s useful & how it works
MalwareBazaar is the go-to free repository when you want to know whether a hash belongs to a catalogued malware sample and, if so, to download the actual file for your own analysis. It is run by abuse.ch in partnership with Spamhaus and is community-contributed, so samples arrive with tags, YARA matches and antivirus labels already attached. Lookups and downloads go through its API; since 2024 you need a free Auth-Key from auth.abuse.ch to authenticate, but registration is open to anyone.
What’s inside
MalwareBazaar holds over one million confirmed malware samples submitted by community researchers and threat intelligence providers. The platform answers roughly 100 million API requests per month, reflecting heavy use by automated threat-intelligence pipelines.
API access
POST https://mb-api.abuse.ch/api/v1/ (query=get_info, hash=); header Auth-Key
An API key is required (usually free); see the endpoints above for where to get one.
What we measured
Our own probes, not the archive’s own claims. Re-run periodically; every reading below is dated.
Reachability
- Direct request
- Responded HTTP 200 321 ms
- Through a datacenter proxy
- Responded HTTP 200 727 ms
- API, direct
- Blocked HTTP 401 161 ms
- API, through a proxy
- Blocked HTTP 401 886 ms
Reachability measured 2026-08-22.
Access
Programmatic API access (a key may be required, see the API tag).