plugmyagent
ThreatFox
Threat Intel Free key (no card)
AuthenticationFree key (no card)
Rate limitNo fixed public quota published; recent-indicator queries are limited to the last 7 days.
Documentation: threatfox.abuse.ch ยท Checked Sep 13, 2026
About
ThreatFox is a free community database run by the Swiss nonprofit abuse.ch that collects 'indicators of compromise'. Technical fingerprints (bad IP addresses, domains, URLs, and file hashes) tied to malware and cyberattacks. Its API lets you look up any suspicious indicator and see which malware family it belongs to and who reported it. You need a free unified abuse.ch auth key, which takes minutes to get.
Details
Free to start. You may need a free key, but no credit card.
Auth: Free key (no card)
Rate limit: No fixed public quota published; recent-indicator queries are limited to the last 7 days.
Verified: 2026-09-13
Best for: personal developer business
Setup
- Register for a free Auth-Key at auth.abuse.ch.
- Send HTTP POST requests to https://threatfox-api.abuse.ch/api/v1/ with an Auth-Key header.
- Use the search_ioc query with the IP, domain, URL, or hash you want to check.
- Read the 'malware' and 'confidence_level' fields in the JSON to judge the threat.
Example
POST https://threatfox-api.abuse.ch/api/v1/ with body {"query":"search_ioc","search_term":"198.51.100.7","exact_match":true}Use cases
- Look up a suspicious IP from your router logs to see if it's known malware infrastructure
- Enrich security alerts with malware-family names automatically
- Build a blocklist feed of recently reported malicious domains