ThreatFox

Free, community-driven platform for sharing Indicators of Compromise (IOCs) related to malware infrastructure, enabling threat intelligence enrichment.

OSINT Threat Intelligence IOC Sharing Malware Detection

Overview

ThreatFox is a free, community-driven platform operated by abuse.ch for sharing Indicators of Compromise (IOCs) related to malware infrastructure. It provides real-time threat intelligence about malicious domains, IP addresses, and URLs. ThreatFox offers an API for automated threat intelligence integration, enabling security teams to enrich alerts, identify malicious infrastructure, and track evolving threat actors. It's widely used for SOC operations, incident response, and threat hunting.

Primary Use Cases

✔ Enriching threat intelligence feeds with real-time malware IOCs and malicious infrastructure data.

✔ Identifying malicious domains, IPs, and URLs during incident response investigations.

✔ Tracking threat actor infrastructure and emerging malware campaigns through shared intelligence.

Frequently Asked Questions

ThreatFox is a free, community-driven IOC sharing platform operated by abuse.ch, providing real-time threat intelligence about malware infrastructure.

Yes, ThreatFox is completely free to use for threat intelligence, IOC sharing, and automated API integration.

ThreatFox provides IOCs including malicious domains, IP addresses, URLs, and malware families, with real-time threat intelligence data.

Yes, ThreatFox provides a REST API for automated threat intelligence integration, enabling security teams to query IOCs and receive real-time updates programmatically.

ThreatFox is used to enrich security alerts, identify malicious infrastructure, track threat actor activity, and enhance SOC operations with real-time threat intelligence.

Metadata

Official Website Visit Website

Category Info

Open Source Intelligence (OSINT) tools for gathering and analyzing publicly available information from various sources including websites, social media, DNS records, public databases, and other open data sources for security investigations and threat intelligence.

Added On

August 18, 2026

Last Updated

August 18, 2026