Abuse.ch is a research project that tracks and monitors malware, botnets, and other cyber threats. It provides various tools and resources to help security professionals identify and combat online abuse, including databases of malicious URLs, compromised websites, and command-and-control servers.
Dark web & threat intelligence for AI agents. HIBP, ThreatFox, ransomware tracking, Tor .onion access, blockchain intel, exploit search, stealer logs, malware analysis — unified into a single MCP server.
66
186 npm
442
MIT
Why this server?
Integrates AbuseIPDB and URLhaus threat intelligence for IP reputation checks and PCAP-wide threat scanning.
A professional-grade network analysis MCP server that integrates Wireshark/TShark, Nmap, and threat intelligence to enable packet capture, network scanning, threat detection, and credential extraction through natural language.
41
2
MIT
Why this server?
Integrates with URLhaus (abuse.ch) to check URLs against active malware distribution lists.
Enables AI agents to check URL safety before fetching content, using Google Web Risk, URLhaus, PhishTank, and AI analysis to return SAFE/SUSPICIOUS/DANGEROUS verdicts.
1
120 npm
1
MIT
Why this server?
Provides access to abuse.ch's threat intelligence platforms (ThreatFox, URLhaus, MalwareBazaar) for searching malicious IOCs, URLs, and malware samples.
Unified dark web and threat intelligence MCP server providing 66 tools across 16 data sources, including breach databases, ransomware tracking, Tor .onion access, blockchain intel, and malware analysis for AI agents.
66
186 npm
MIT
Why this server?
Provides unified access to abuse.ch projects including URLhaus for malware distribution URLs, MalwareBazaar for sample lookups by hash, ThreatFox for IOC sharing, and Feodo Tracker for identifying active botnet C2 infrastructure.
Provides unified access to multiple threat intelligence sources like AlienVault OTX, AbuseIPDB, and GreyNoise for security research and analysis. It enables users to perform simultaneous lookups on IPs, domains, hashes, and URLs across several platforms within a single response.
7
50 npm
7
MIT
Why this server?
Integrates with MalwareBazaar (a service by abuse.ch) to provide real-time threat intelligence, including querying recent malware samples, retrieving metadata by hash, and searching by tags.
Enables AI assistants to access real-time threat intelligence, malware sample metadata, and security analysis tools via integration with MalwareBazaar, VirusTotal, and Telegram.
29
MIT
Why this server?
Integrates with abuse.ch services (URLhaus, ThreatFox, MalwareBazaar) to look up malware samples, search IOCs, retrieve recent submissions, and pivot on hashes, families, tags, and hosts.
Enables detection engineers to search, build, validate, and correlate detection rules across multiple SIEM formats using MITRE ATT&CK, Atomic Red Team, and threat intelligence.
129
-
Why this server?
Integrates with Abuse.ch ThreatFox to fetch threat intelligence indicators.
Aggregates security intelligence feeds (vulnerabilities, news, threat intel) into a local SQLite database and provides MCP tools for AI agents to query and analyze them.
MIT
Why this server?
Provides threat intelligence lookup capabilities by integrating with abuse.ch, allowing AI agents to check indicators of compromise (IOCs) such as IP addresses and domains against known malicious activity databases.
