Best abuse.ch MCP Servers
Abuse.ch is a research project that tracks and monitors malware, botnets, and other cyber threats. It provides various tools and resources to help security professionals identify and combat online abuse, including databases of malicious URLs, compromised websites, and command-and-control servers.
Why this server?
Provides unified access to abuse.ch projects including URLhaus for malware distribution URLs, MalwareBazaar for sample lookups by hash, ThreatFox for IOC sharing, and Feodo Tracker for identifying active botnet C2 infrastructure.
FlicenseAqualityCmaintenanceProvides unified access to multiple threat intelligence sources like AlienVault OTX, AbuseIPDB, and GreyNoise for security research and analysis. It enables users to perform simultaneous lookups on IPs, domains, hashes, and URLs across several platforms within a single response.Last updated7833Why this server?
Integrates with abuse.ch services including URLhaus, ThreatFox, and MalwareBazaar for malware URL tracking, IOC sharing, and malware sample intelligence.
Alicense-qualityCmaintenanceA threat intelligence aggregation server that provides unified access to multiple security sources for analyzing indicators (IPs, domains, hashes, URLs) with confidence scoring.Last updated7MITWhy this server?
Provides tools for querying the ThreatFox indicator-of-compromise feed from abuse.ch, allowing AI agents to search IOCs by file hash or malware family.
Alicense-qualityCmaintenanceEnables searching for indicators of compromise from ThreatFox by file hash (MD5/SHA1/SHA256) or malware family name.Last updated8MITWhy this server?
Integrates with MalwareBazaar to provide real-time threat intelligence, sample metadata, and file downloads for cybersecurity research.
Alicense-qualityCmaintenanceAn AI-driven MCP server that autonomously interfaces with Malware Bazaar, delivering real-time threat intel and sample metadata for authorized cybersecurity research workflows.Last updated30Apache 2.0Why this server?
Provides a unified API layer for querying threat intelligence from multiple abuse.ch platforms including MalwareBazaar, URLhaus, and ThreatFox, enabling comprehensive reports on files, URLs, IPs, and domains for cybersecurity analysis.
Flicense-qualityCmaintenanceEnables querying threat intelligence data about files, URLs, IPs, and domains from multiple abuse.ch platforms (MalwareBazaar, URLhaus, and ThreatFox) through a unified API. Provides comprehensive security reports and threat analysis data for cybersecurity investigations.Last updated2Why this server?
Provides integration with the MalwareBazaar API to retrieve recent malware sample metadata, search for samples by specific tags, and access detailed metadata for SHA256 hashes.
Flicense-qualityCmaintenanceProvides real-time threat intelligence and malware metadata by integrating with MalwareBazaar and VirusTotal APIs. Users can search for IOCs, analyze local file hashes, and access data transformation tools for defensive security research.Last updated