ThreatFox (abuse.ch) alternatives
6 tools in the catalogue cover the same ground as ThreatFox (abuse.ch) and can replace it depending on the need. Each one is reachable, re-checked daily, and listed with its pricing.
- abuse.ch HuntingfreeCross-search over the abuse.ch feeds: malicious URLs, samples, botnet command servers and SSL fingerprints, from one of the most cited non-profit sources.
- BI.ZONE Threat IntelligencefreemiumThreat portal with strong coverage of groups active in the post-Soviet space, an area where Western sources are thin.
- Feodo TrackerfreeTracks command-and-control servers of banking trojans such as Emotet, Dridex and TrickBot.
- GitGuardian Public MonitoringfreemiumWatches public repositories for credentials leaked by an organisation's developers. Catches keys published by mistake, often within minutes.
- GreyNoisefreemiumThreat intelligence platform that classifies IP addresses scanning the internet as malicious, benign, or noise using a global sensor network. 50 free daily API calls.
- GTFOBinsfreeCurated list of Unix binaries that can bypass local security restrictions in misconfigured systems.
ThreatFox (abuse.ch)
Threat Intelligence
Also written Threat Fox (abuse.ch), ThreatFox (abuse ch), ThreatFox(abuse.ch)
Free threat intelligence platform by abuse.ch for sharing indicators of compromise (IOCs) — IPs, domains, URLs, hashes — with community attribution and MITRE ATT&CK mapping.
RECOMMENDED USE
IOC lookup and sharing, threat actor infrastructure identification
Launch ThreatFox (abuse.ch) directly
Enter your target: the link opens with the query already filled in. Nothing is sent from this site.
Expected input: recherche
Information
Video tutorials
Learn to use ThreatFox (abuse.ch)
Suggested workflow
Chain these tools in order for a complete investigation
Similar tools
These tools can also help you
OTX AlienVault
Threat IntelligenceOpen Threat eXchange — world's largest open threat intelligence community with 100k+ participants sharing 20M+ threat indicators. Search IPs, domains, hashes, CVEs and subscribe to threat pulses.
Pulsedive
Threat IntelligenceThreat intelligence platform for enriching IPs, domains, URLs, and hashes — correlating risk scores, linked threats, and historical context from 30+ sources. 30 free lookups/day.
URLhaus (abuse.ch)
Threat IntelligenceCommunity-driven database of malicious URLs used for malware distribution. Searchable by URL, domain, IP, CIDR, or hash. Integrates with threat feeds and blocklists.
MISP Galaxy
Threat IntelligenceOpen, machine-readable knowledge base of threat actors, tools and techniques, used to share intelligence between organisations in a common vocabulary.
User reviews
Be the first to leave a review