Abuse.ch Threat Feeds
Community threat intel family: URLhaus, MalwareBazaar, ThreatFox, and YARAify, in partnership with Spamhaus.
Technical Architecture & Overview
Abuse.ch operates free malware and IOC platforms: URLhaus for malware-distribution URLs, MalwareBazaar for sample sharing, ThreatFox for IOC exchange, and YARAify for YARA rule matching. The project operates in partnership with Spamhaus, and API access requires a free account and Auth-Key. Free use covers not-for-profit query volumes, while commercial use may require a paid subscription managed by Spamhaus. URLhaus also publishes daily MISP events, Snort and Suricata rulesets, and DNS RPZ data.
Targeted Technical Use Cases
Free IOC and malware feeds for blocklists, hunting, and enrichment pipelines.
Evaluation & Trade-offs
Core Strengths
- +Community-driven data relied on by researchers and network operators.
- +Multiple feed types covering URLs, samples, and IOCs.
- +Exports in MISP, Snort/Suricata, RPZ, and hostfile formats.
Trade-Offs & Limitations
- -Free API access requires an account and is subject to query volume limits.
- -Feeds reflect what the community reports, not a full threat picture.
Defensive Security Application
Feeding network blocklists and detection content with current, community-shared IOCs.
Frequently Asked Questions
What is Abuse.ch Threat Feeds?→
Abuse.ch operates free malware and IOC platforms: URLhaus for malware-distribution URLs, MalwareBazaar for sample sharing, ThreatFox for IOC exchange, and YARAify for YARA rule matching. The project operates in partnership with Spamhaus, and API access requires a free account and Auth-Key. Free use covers not-for-profit query volumes, while commercial use may require a paid subscription managed by Spamhaus. URLhaus also publishes daily MISP events, Snort and Suricata rulesets, and DNS RPZ data.
What is Abuse.ch Threat Feeds used for?→
Free IOC and malware feeds for blocklists, hunting, and enrichment pipelines.
What are the strengths of Abuse.ch Threat Feeds?→
- +Community-driven data relied on by researchers and network operators.
- +Multiple feed types covering URLs, samples, and IOCs.
- +Exports in MISP, Snort/Suricata, RPZ, and hostfile formats.
What are the limitations of Abuse.ch Threat Feeds?→
- +Free API access requires an account and is subject to query volume limits.
- +Feeds reflect what the community reports, not a full threat picture.
How is Abuse.ch Threat Feeds used defensively?→
Feeding network blocklists and detection content with current, community-shared IOCs.