abuse.ch API vs community: What’s the difference?
The community platforms are built on contributions from a dedicated and committed community of specialist researchers, and the data is made freely available to everyone who shares in that effort.
Our abuse.ch API is built for a different need: it’s for organisations that depend on the data in their products or operations. It adds robust infrastructure, dedicated technical support, priority false-positive handling and now even more, so teams can build it into their workflows with confidence.
To understand what’s included in the API service, see this comparison table:
| Features | Commercial | Community |
|---|---|---|
| Datasets | ||
| Malware URLs (URLhaus) | Yes | Yes |
| Malware Samples (MalwareBazaar) | Yes | Yes |
| Malware IoCs (ThreatFox) | Yes | Yes |
| Access and support | ||
| Licensed for use in commercial products/services | Yes | No |
| Dedicated technical support | Yes | No |
| Enterprise-grade service | Yes | No |
| Priority false-positive handling | Yes | No |
| Functions | ||
| Integrations | Yes: Elastic now, with OpenCTI and Cortex XSOAR coming | Third-party connectors available |
| Revocation list for withdrawn indicators | Yes | No |
| Rate-limiting | Not subject to the community’s daily rate limit. | Daily rate limit with access paused once rate limit is exceeded. |
Not sure which API you need?
If you're a commercial organization using the community API, or require high query volumes, and you’re not contributing valuable data back to platforms, then the abuse.ch API is the right fit. It's built for organisations whose internal and external customers depend on the data: more capacity, robust infrastructure and dedicated support - you can trial this service for 30 days for free here.
How teams use the abuse.ch API
Customers are utilizing the API for one of two core use cases:
- Threat hunting: to power IoC-driven investigations, campaign tracking and rapid technical validation.
- Threat intelligence enrichment: to add diversity and coverage to existing intelligence and help quickly decide whether a malware indicator matters to the environment.
What's new
Everything on our roadmap is shaped from the suggestions and challenges customers bring to us. Here’s what we’ve delivered:
Elastic integration (New!)
Data is most useful when it's already in the tools you use every day. That’s why integrations are at the centre of how we're developing the API. And why we’re delighted to share the abuse.ch API is now available on the Elastic marketplace. Once connected, the integration automatically pulls indicators from URLhaus, MalwareBazaar andThreatFox into Elastic, ready for threat intel matching, alert enrichment, threat hunting and prebuilt Kibana dashboards.
File exports (New!)
If you prefer to work with the data in bulk, the data is now available via file exports. The data comes in a variety of structured formats including detection and security tool-specific formats, e.g., for MISP, and hash-focused lists.
Flexible authentication (Update)
API-key authentication now works alongside JWT, so platforms that don't accept JWT can connect directly.
Improved data hygiene (Update)
A new revocation-list endpoint gives you a clean way to invalidate withdrawn indicators, so downstream caches stay accurate.
Better query controls (Update)
The new until parameter, combined with pagination controls, gives you precise control over historical backfills and range-based queries.
What’s coming
More integrations are on the way, along with new functionality and data collections. Here's a look at what's coming down the line:
-
Native OpenCTI integration: built with Filigran, the team behind OpenCTI, so the data lands in your threat intelligence platform ready to correlate.
-
Native Cortex XSOAR integration: automated enrichment and response playbooks driven by abuse.ch indicators.
-
Unified API: query malware URLs, IoCs and samples through a single endpoint. Available exclusively to commercial customers.
If there’s something you want to see, or a platform you'd like to integrate the API with, let us know here,
Getting started with the abuse.ch API
To find out how the API could support your threat hunting or threat intelligence enrichment, start a free 30-day trial or get in touch to discuss pricing or your specific use case.