plugmyagent

MalwareBazaar

Threat Intel Free key (no card)

AuthenticationFree key (no card)
Rate limitDownloads capped around 2,000 samples per IP per day; queries are not strictly quotaed.

Documentation: bazaar.abuse.ch ยท Checked Sep 13, 2026

About

MalwareBazaar is abuse.ch's free library of real malware samples, searchable by file hash, malware family name, file type, or digital signature. The API answers questions like 'what is this suspicious file I downloaded?'. It returns the file's name, family (e.g. RedLineStealer), tags, and when it was first seen. Researchers can also download samples for sandbox analysis (password-protected, safely quarantined), with daily download caps.

Details

Free to start. You may need a free key, but no credit card.

Auth: Free key (no card)

Rate limit: Downloads capped around 2,000 samples per IP per day; queries are not strictly quotaed.

Verified: 2026-09-13

Best for: developer business fun

Read the docs Back to catalog

Setup

  1. Get the free abuse.ch Auth-Key at auth.abuse.ch (same key as ThreatFox).
  2. POST to https://mb-api.abuse.ch/api/v1/ with 'Auth-Key' header and a query like get_info.
  3. Search by hash, family name (get_siginfo), or tag to identify samples.
  4. Download samples with get_file only into an isolated sandbox. They are live malware.
Sign up