Leveraging the collective capabilities of a large, experienced and thriving malware community, these threat intelligence feeds provide a rich source of actionable data focussed on IOCs. This subscription also offers exclusive access to raw connection data through controlled malware detonation by abuse.ch, with the Sandnet feed.
Solutions
Data
Email & Network
Cyber Threat Intelligence
Resources
About
abuse.ch
Real-Time Feeds
Accessing the abuse.ch Malware Data via real-time feeds provides security teams with a high-value, low-friction source of threat intelligence. Easy to use and quick to deploy, these feeds directly enhance threat detection, triage, hunting, and enrichment workflows. Gain immediate access to fresh IOCs to proactively identify threats before they cause damage.
Improve Threat Detection and Response
Of-the-moment IOCs (IPs, domains, hashes etc.) so analysts can act faster on alerts and reduce time-to-detection.
Easy Integration and Automation
Feeds are lightweight and work seamlessly with SIEMs and other TIPs - ideal for automating enrichment.
Proactive Threat Hunting and IOC Pivoting
Discover emerging threats and trace related infrastructure to support deeper investigations and IOC expansion.
abuse.ch Malware Data via Real-Time Feeds
Why are there two different names for the data?
Our datasets have been supporting users for a very long time. With new users requesting our support, the dataset names are being updated for clearer understanding. We’re documenting two names, for now, to best support all users.
Datasets Included
Use cases for abuse.ch Malware Data via Real-Time Feeds
Utilizing enriched IOCs via real-time feeds offer numerous opportunities for cyber threat intelligence practitioners, including (but not limited to!) threat hunters, SOC analysts and threat intelligence analysts.
Threat Intelligence Enrichment
Threat Hunting
Threat Intelligence Enrichment
Threat Intelligence Enrichment
Threat Hunting
abuse.ch Malware Data via Real-Time Feeds for Threat Intelligence Enrichment
Enrich alerts to triage faster by correlating internal telemetry with fresh IOC data; cut down false positives and speed up incident prioritization. Feeds can be integrated into SIEM/EDR rules to auto-tag threats, triggering priority alerts based on the latest threat data. With minimal configuration or scripting required, data can also be ingested into reports for lower operational overhead so analysts can focus on priorities.
Threat Prioritization
Using focussed, real-time IOC context, better prioritize threats, and focus resources on high-risk activity with clearer alerts
Accelerated Alert Triage
Reduce manual investigation time and ease alert overload with directive IOC metadata that can be utilized through automations
Increase accuracy in Threat Classification
The abuse.ch data is a specialist source of active, high-impact threats for analysts to focus on genuine threats.
abuse.ch Malware Data via Real-Time Feeds for Threat Hunting
Improve the efficiency and effectiveness of threat hunting with immediate access to real-time IOCs to proactively identify threats before they cause damage. Correlate these feeds with internal telemetry to spot emerging attack patterns or repeated malicious infrastructure usage. This real-time context lets you identify active malicious behaviour earlier, supported by related metadata to aid pivoting to find additional threats.
Security Efficiency
With up-to-date feeds, hunters can focus efforts on real, active threats rather than chasing false leads.
Improved Resource Use
Improve workflow speed and increase focus on the most high-impact threats to optimise time spent on hunting.
Reduced Dwell Time
Fresh IOCs help hunters detect threats early, shrinking the window between compromise and discovery. This limits data loss, reduces remediation scope, and lowers the financial impact of breaches.
Getting started
How do I start a free 30 day trial?
Simply complete the form and submit. No credit card or payment details are required for the free trial.
What happens next?
You’ll receive an email asking you to verify your address, and a member of the team will contact you to enable your access.
Once verified, log in to the Customer portal and follow the setup instructions provided in the manual.
Need help?
If you have any questions, please add them to the comments box provided in the form. Once you gain access to the data, technical support is available via our Customer Portal.
How can I purchase the data?
During your free trial, you can request a quote in the Customer Portal to get the subscription cost based on your requirements. You can also enable trials of additional datasets via the Customer Portal.
System requirements
Technical Documentation
Pricing
Ready to start
your free trial?
Get a free 30-day trial to query abuse.ch Real-Time Feeds. No credit card details required.
Frequently Asked Questions
Who should use abuse.ch Malware Data via Real-Time Feeds?
There are many ways to use this data across the cyber threat intelligence disciple, including, but not limited to:
- SOC Analysts - To enrich alerts, accelerate triage, and improve detection accuracy using up-to-date, verified IOCs.
- Threat Hunters - To proactively identify emerging threats, uncover attacker infrastructure, and pivot across indicators for deeper investigations.
- Threat Intelligence Teams - To feed reliable, real-time IOCs into threat intelligence platforms (TIPs) and correlate internal data with global threat trends.
- Incident Responders - To rapidly validate and scope incidents, identify related indicators, and guide containment efforts with high-confidence data.
- MDR/MSSP Providers - To enhance managed services by incorporating high-impact, trusted intel into monitoring, detection, and response pipelines for clients.
Explore more
Data Access
Passive DNS API
Learn More A simple API supporting a variety of query types to discover historical, and up-to-the-moment, DNS infrastructure connections from Spamhaus’ Passive DNS database with up to one year of historical data.
Data Access
Intelligence API
Learn More Integrate context-rich metadata relating to IP and domain reputation to enhance existing data feeds, or consume as an independent data source. Gain additional intelligence to monitor, assess and remediate as required.
Integration
Maltego Integration
Learn More With Maltego, streamline complex analysis by utilizing the Spamhaus-abuse.ch Alliance’s expansive malware, IP and domain reputation intelligence. Quickly understand whether entities should be considered high risk, why, and whether it is still perpetuating malicious behavior to confidently define and prioritise next steps.