Abuse.ch is a research project that tracks and monitors malware, botnets, and other cyber threats. It provides various tools and resources to help security professionals identify and combat online abuse, including databases of malicious URLs, compromised websites, and command-and-control servers.
Integrates with abuse.ch services ThreatFox, URLhaus, and MalwareBazaar for threat intelligence lookups on domains, IPs, URLs, and hashes, requiring an abuse.ch Auth-Key.
Enables AI agents to investigate domains, emails, IPs, hashes, URLs, onion addresses, Bitcoin addresses and CVEs across 68 tools spanning 19 threat-intelligence and dark-web source categories, returning bounded evidence with provenance, coverage and explicit skipped, errored or inconclusive checks. It also ships a local investigation dashboard for running combined lookups, reviewing source readiness and downloading JSON reports.
68
2
MIT
Why this server?
Provides unified access to abuse.ch projects including URLhaus for malware distribution URLs, MalwareBazaar for sample lookups by hash, ThreatFox for IOC sharing, and Feodo Tracker for identifying active botnet C2 infrastructure.
Provides unified access to multiple threat intelligence sources like AlienVault OTX, AbuseIPDB, and GreyNoise for security research and analysis. It enables users to perform simultaneous lookups on IPs, domains, hashes, and URLs across several platforms within a single response.
7
31 npm
9
MIT
Why this server?
Enables AI agents to query abuse.ch services such as ThreatFox for malware IOCs, URLhaus for malicious URLs, and other threat intelligence feeds.
Dark web & threat intelligence for AI agents. HIBP, ThreatFox, ransomware tracking, Tor .onion access, blockchain intel, exploit search, stealer logs, malware analysis — unified into a single MCP server.
66
240 npm
477
MIT
Why this server?
Integrates AbuseIPDB and URLhaus threat intelligence for IP reputation checks and PCAP-wide threat scanning.
A professional-grade network analysis MCP server that integrates Wireshark/TShark, Nmap, and threat intelligence to enable packet capture, network scanning, threat detection, and credential extraction through natural language.
41
2
MIT
Why this server?
Integrates with URLhaus (abuse.ch) to check URLs against active malware distribution lists.
Enables AI agents to check URL safety before fetching content, using Google Web Risk, URLhaus, PhishTank, and AI analysis to return SAFE/SUSPICIOUS/DANGEROUS verdicts.
1
11 npm
1
MIT
Why this server?
Provides access to abuse.ch's threat intelligence platforms (ThreatFox, URLhaus, MalwareBazaar) for searching malicious IOCs, URLs, and malware samples.
Unified dark web and threat intelligence MCP server providing 66 tools across 16 data sources, including breach databases, ransomware tracking, Tor .onion access, blockchain intel, and malware analysis for AI agents.
66
240 npm
3
MIT
Why this server?
Provides access to abuse.ch's URLhaus threat intelligence platform, enabling queries for malicious URLs, host/domain information, malware payloads, and malware tags or signatures.
MCP server for accessing URLhaus malicious URL database from abuse.ch - provides threat intelligence for cybersecurity research
7
2 npm
5
MIT
Why this server?
Provides threat intelligence lookup capabilities by integrating with abuse.ch, allowing AI agents to check indicators of compromise (IOCs) such as IP addresses and domains against known malicious activity databases.
Provides a high quality cybersecurity tool platform with pay as you go pricing (no subscription).
28
1
MIT
Why this server?
Integrates with MalwareBazaar (a service by abuse.ch) to provide real-time threat intelligence, including querying recent malware samples, retrieving metadata by hash, and searching by tags.
Enables AI assistants to access real-time threat intelligence, malware sample metadata, and security analysis tools via integration with MalwareBazaar, VirusTotal, and Telegram.