malware-intel
ThreatFox (abuse.ch)
An open indicator-of-compromise sharing platform from abuse.ch, cataloguing millions of IPs, domains, hashes and URLs tied to named malware. It is queried via its API with the free abuse.ch Auth-Key. Useful for putting an artifact in context: search a hash or domain and learn which malware family or campaign it has been associated with.
Чем полезен и как работает
ThreatFox is the indicator-of-compromise (IOC) sharing arm of the abuse.ch ecosystem. Where MalwareBazaar holds samples and URLhaus holds distribution links, ThreatFox is about context: it ties IPs, domains, hashes and URLs to specific named malware families and campaigns, letting you place an artifact within a broader threat picture. The same free abuse.ch Auth-Key used for MalwareBazaar and URLhaus works here, and you can search by hash, IP, domain or URL through the API.
Что внутри
ThreatFox has accumulated millions of IOC entries from community contributors since it launched in March 2021. As of 2025, IOCs older than six months are expired from the live API feed but remain searchable through the website, so the browsable archive is larger than the real-time export.
Доступ по API
POST https://threatfox-api.abuse.ch/api/v1/ (query=search_ioc/search_hash); header Auth-Key
Требуется ключ API (обычно бесплатный); где его получить — см. эндпоинты выше.
Доступ
Programmatic API access (a key may be required, see the API tag).