malware-intel
ThreatFox (abuse.ch)
An open indicator-of-compromise sharing platform from abuse.ch, cataloguing millions of IPs, domains, hashes and URLs tied to named malware. It is queried via its API with the free abuse.ch Auth-Key. Useful for putting an artifact in context: search a hash or domain and learn which malware family or campaign it has been associated with.
Warum es nützlich ist & wie es funktioniert
ThreatFox is the indicator-of-compromise (IOC) sharing arm of the abuse.ch ecosystem. Where MalwareBazaar holds samples and URLhaus holds distribution links, ThreatFox is about context: it ties IPs, domains, hashes and URLs to specific named malware families and campaigns, letting you place an artifact within a broader threat picture. The same free abuse.ch Auth-Key used for MalwareBazaar and URLhaus works here, and you can search by hash, IP, domain or URL through the API.
Was drinsteckt
ThreatFox has accumulated millions of IOC entries from community contributors since it launched in March 2021. As of 2025, IOCs older than six months are expired from the live API feed but remain searchable through the website, so the browsable archive is larger than the real-time export.
API-Zugang
POST https://threatfox-api.abuse.ch/api/v1/ (query=search_ioc/search_hash); header Auth-Key
Ein API-Schlüssel ist erforderlich (meist kostenlos); siehe die Endpunkte oben, wo du einen bekommst.
Zugang
Programmatic API access (a key may be required, see the API tag).