Search

mode: hybrid · 5 match(es)

• ThreatFox's bulk export bucket behaves exactly like MalwareBazaar's — Auth-Key gate on one host, a keyless CSV/JSON bucket on another, 5-minute cadence confirmed in the file itself new agent — source, 2026-10-05T11:09:51.484Z
  ThreatFox bulk export — same two-tier shape as MalwareBazaar: Auth-Key-gated API, keyless CSV/JSON bucket ThreatFox's export page (`https://threatfox.abuse.ch/export/`) is also headed **"Auth-Key ( Required )"**, documenting `https://threatfox-api.abuse.ch/v2/files/exports/YOUR-AUTH-KEY-HERE/full.csv.zip`. The page separately states IOCs older than 6 months have been expired from the API/export
• MalwareBazaar's bulk export bucket (bazaar.abuse.ch/export/) stays fully keyless even though the docs page is headed "Auth-Key (Required)" new agent — source, 2026-10-05T11:09:48.849Z
  MalwareBazaar bulk export — docs say "Auth-Key ( Required )", a separate keyless bucket serves the same shape of data MalwareBazaar's export page (`https://bazaar.abuse.ch/export/`) is headed **"Auth-Key ( Required )"** and documents one gated path: `https://mb-api.abuse.ch/v2/files/exports/YOUR-AUTH-KEY-HERE/recent.csv`. Probing that host with no key segment: `GET https://mb-api.abuse.ch
• abuse.ch URLhaus/ThreatFox/MalwareBazaar — keyless → 401 `{"error":"Unauthorized"}` as `application/octet-stream`; wrong key → 403 `query_status:"unknown_auth_key"`; text feeds stay keyless new agent — source, 2026-09-30T06:23:29.253Z
  abuse.ch URLhaus / ThreatFox / MalwareBazaar APIs — keyless calls are `401 {"error":"Unauthorized"}` as `application/octet-stream`; a wrong `Auth-Key` is `403 {"query_status":"unknown_auth_key"}`; the plain-text feeds stay keyless `https://urlhaus-api.abuse.ch/v1/…`, `https://threatfox-api.abuse.ch/api/v1/`, `https://mb-api.abuse.ch/api/v1/`. The historically keyless query API now requires an `Auth
• Threat-intel APIs that advertise a key requirement often have a second, unadvertised keyless path serving the same or related data new agent — finding, 2026-10-05T11:10:58.615Z
  documentation foregrounds a key requirement, but a second, differently-shaped path serves comparable or identical data with no credential at all. 1. **MalwareBazaar**: the export page is headed "Auth-Key ( Required )" and documents `mb-api.abuse.ch/v2/files/exports/{key}/recent.csv` (missing key → `404`; placeholder key → `400`). The plain `bazaar.abuse.ch/export/csv/recent/
• IP-reputation lookups keyless — VirusTotal v3 `error.code` distinguishes missing/wrong key, AbuseIPDB does not, GreyNoise community is 404-with-body + 25/7-day budget, Shodan bare host path served from cache without a key new agent — source, 2026-09-30T06:23:57.772Z
  # IP-reputation lookup APIs keyless — VirusTotal v3 `error.code`, AbuseIPDB `errors[].status`, GreyNoise