Check a SHA256 hash against a daily updated store of known-malicious file indicators to get an instant yes/no verdict on whether the hash matches a known bad artifact.
MIT
642,899 tools. Updated 2026-10-05 22:41
"abuse.ch" matching MCP tools:
- Check a domain against abuse.ch URLhaus to identify known malware-distribution URLs and assess domain-level threat status. Returns malware URLs, threat tags, and a summary for security triage.MIT
- Auto-detect IOC type and enrich IPs, domains, URLs, or hashes by querying abuse.ch feeds for threat level, sources, and a summary. Returns a verdict with queried and unavailable sources for quick triage.MIT
- Query multiple malware intelligence sources for a file hash to retrieve prior analysis summaries and metadata without detonating the sample.MIT
- Enrich up to 50 IPs, domains, URLs, or hashes per request by auto-detecting types and querying abuse.ch feeds. Returns per-indicator verdicts with source coverage, enabling SOC alert triage or batch enrichment.MIT
- Check if an IP or domain is a known botnet command-and-control server by cross-referencing C2 blocklists like Feodo Tracker, ThreatFox, and URLhaus.MIT
Matching MCP Servers
- AlicenseNot gradedqualityDmaintenanceEnables querying threat intelligence data about files, URLs, IPs, and domains from multiple abuse.ch platforms (MalwareBazaar, URLhaus, and ThreatFox) through a unified API. Provides comprehensive security reports and threat analysis data for cybersecurity investigations.3MIT
- AlicenseAqualityCmaintenanceMCP server for accessing URLhaus malicious URL database from abuse.ch - provides threat intelligence for cybersecurity research76 npm5MIT
Matching MCP Connectors
- VetariOAuth
Swiss company-register intelligence: new GmbHs by canton, shared addresses, UID history, SHAB text
Swiss phone directory: search people and businesses, reverse number lookup, business categories.
- Check a domain against malware blocklists to determine if it is associated with malware, and identify the source if found.MIT
- Retrieve recent indicators of compromise from ThreatFox (abuse.ch) for threat intelligence and security analysis. Specify the number of days to look back.MIT
- Submit an MD5, SHA1, or SHA256 hash to retrieve malware sample details from MalwareBazaar.MIT
- Retrieve recent indicators of compromise from ThreatFox for a custom time range. Enrich threat investigations with actionable IoC data.MIT
- Look up malware samples in MalwareBazaar by MD5, SHA1, or SHA256 hash to determine if a file is malicious.MIT
- Fetch the most recently submitted malware samples from MalwareBazaar for threat intelligence and analysis.MIT
- Check a domain against free threat intelligence feeds (Spamhaus DBL, SURBL, URLhaus) to identify malicious listings and receive threat categories.MIT
- Retrieve recent malware submissions from MalwareBazaar to monitor emerging threats. Pull freshly uploaded samples for security analysis.MIT
- Look up a URL or host in URLhaus to check for malware associations. Provide a full URL or hostname/IP for threat intelligence.MIT
- Search URLhaus by tag to find malicious URLs associated with malware families like Emotet or Dridex.MIT
- Search MalwareBazaar for malware samples by tag or YARA signature name.MIT
- Check if a URL or host is malicious by querying URLhaus (abuse.ch). Provide a full URL or hostname/IP to see if it's listed.MIT
- Search URLhaus threat intelligence for malware samples by tag, such as Emotet or Dridex, to identify and analyze malicious URLs.MIT
- Search MalwareBazaar by malware tag or YARA signature to identify samples from threat campaigns.MIT
- Resolves a domain and checks its IP against known sinkhole operators to determine if the domain is sinkholed and by which operator.MIT