malware-intel
ThreatFox (abuse.ch)
An open indicator-of-compromise sharing platform from abuse.ch, cataloguing millions of IPs, domains, hashes and URLs tied to named malware. It is queried via its API with the free abuse.ch Auth-Key. Useful for putting an artifact in context: search a hash or domain and learn which malware family or campaign it has been associated with.
Why it’s useful & how it works
ThreatFox is the indicator-of-compromise (IOC) sharing arm of the abuse.ch ecosystem. Where MalwareBazaar holds samples and URLhaus holds distribution links, ThreatFox is about context: it ties IPs, domains, hashes and URLs to specific named malware families and campaigns, letting you place an artifact within a broader threat picture. The same free abuse.ch Auth-Key used for MalwareBazaar and URLhaus works here, and you can search by hash, IP, domain or URL through the API.
What’s inside
ThreatFox has accumulated millions of IOC entries from community contributors since it launched in March 2021. As of 2025, IOCs older than six months are expired from the live API feed but remain searchable through the website, so the browsable archive is larger than the real-time export.
API access
POST https://threatfox-api.abuse.ch/api/v1/ (query=search_ioc/search_hash); header Auth-Key
An API key is required (usually free); see the endpoints above for where to get one.
What we measured
Our own probes, not the archive’s own claims. Re-run periodically; every reading below is dated.
Reachability
- Direct request
- Responded HTTP 200 255 ms
- Through a datacenter proxy
- Responded HTTP 200 851 ms
- API, direct
- Blocked HTTP 401 105 ms
- API, through a proxy
- Blocked HTTP 401 748 ms
Reachability measured 2026-08-22.
Access
Programmatic API access (a key may be required, see the API tag).