Skip to main content
Glama
643,290 tools. Updated 2026-10-06 00:37

"abuse.ch" matching MCP tools:

  • ioc_lookupA

    ContrastAPIA

    Enrich Indicator of Compromise (IP/domain/URL/hash) by auto-detecting type and querying abuse.ch feeds. Per-type source coverage: hash → ThreatFox only (Feodo and URLhaus do not index hashes); IP → ThreatFox + Feodo Tracker + URLhaus; domain / URL → ThreatFox + URLhaus. verdict.sources_queried lists what actually ran; verdict.sources_unavailable lists what failed (timeout / upstream error). Use as primary IOC triage tool when type unknown; use threat_intel for domain-only, hash_lookup for richer MalwareBazaar hash data. Free: 30/hr, Pro: 500/hr. Returns {indicator, type, threat_level, sources, summary, verdict}.
    ConnectorNo auth

  • bulk_ioc_lookupA

    ContrastAPIA

    Batch query multiple IOCs (IP/domain/URL/hash, up to 50 per call, same for Free and Pro) in 1 request: auto-detects type + queries abuse.ch feeds per-indicator. Per-type source coverage matches ioc_lookup: hash → ThreatFox only; IP → ThreatFox + Feodo + URLhaus; domain / URL → ThreatFox + URLhaus. Each result item carries its own verdict.sources_queried / sources_unavailable so partial failures are visible per indicator. Use for SOC alert triage or batch enrichment; use ioc_lookup for single indicator. Free: 30/hr (1 per item), Pro: 500/hr. Returns {results, total, successful, failed, timed_out, partial, summary}.
    ConnectorNo auth

  • threat_intelA

    ContrastAPIA

    Check domain against abuse.ch URLhaus for known malware-distribution URLs (single source — for multi-feed correlation use ioc_lookup which adds ThreatFox and, for IPs, Feodo Tracker). Use for fast domain-level threat assessment; use phishing_check for specific URLs. Free: 30/hr, Pro: 500/hr. Returns {malware_urls, threat_tags, threat_status, summary}.
    ConnectorNo auth

  • ip_reputationA

    LiveDataLinkB

    Risk profile for an IP address: geolocation and network (ASN/ISP/org) plus two abuse signals - whether it is a known Tor exit node, and whether it appears on the abuse.ch Feodo botnet command-and-control blocklist. For fraud, abuse, and security screening. Keyless.
    ConnectorNo auth

  • threat_intel_lookupA

    AgentAegisA

    Reputation and indicator lookup for an IP or domain across AbuseIPDB, AlienVault OTX and abuse.ch. The cheapest way to check whether an indicator is known-bad. Interpret with care: large CDN, cloud and payment infrastructure routinely returns reputation hits, so only a curated active-malware hit is strong evidence on its own. Costs $2 per call.
    ConnectorNo auth

  • known_bad_lookupA

    lazarettoA

    Check a SHA-256 against Lazaretto's known-bad indicator set (refreshed daily from abuse.ch). Free and anonymous. A miss only means this exact hash is not in the indicator set; it is not a clean verdict on the artifact.
    ConnectorNo auth

Matching MCP Servers

  • Abuse.ch Threat Intelligence

    lokallost
    A
    license
    Not graded
    quality
    D
    maintenance
    Enables querying threat intelligence data about files, URLs, IPs, and domains from multiple abuse.ch platforms (MalwareBazaar, URLhaus, and ThreatFox) through a unified API. Provides comprehensive security reports and threat analysis data for cybersecurity investigations.
    3
    MIT

Matching MCP Connectors

  • VetariOAuth

    Swiss company-register intelligence: new GmbHs by canton, shared addresses, UID history, SHAB text

  • 1820.ch – Telefonbuch Schweiz

    Swiss phone directory: search people and businesses, reverse number lookup, business categories.

  • url_reputationA

    Presend MCP ServerA

    Checks a URL against URLhaus (abuse.ch), a public database of known malware distribution URLs. A clean result only means the URL is not listed, not that it is safe.
    ConnectorNo auth