{"uid":"cap_h6lOL5Jbw__A8gRw-17P9","slug":"sitecheck-web-intel-threatfox-ioc-lookup-bf3ee5bc","name":"SiteCheck Web Intel – ThreatFox IOC Lookup","description":"Searches abuse.ch ThreatFox for indicators of compromise matching a term (IP, IP:port, domain, URL or file hash): IOC, type, malware family, threat type, confidence, first/last seen, reporter, tags and Malpedia link. Optional exact match and a first-seen window in days.","url":"https://api.webintel-api.workers.dev/api/security/threatfox-iocs?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["term"],"properties":{"days":{"type":"string","description":"Only IOCs first seen in the last N days, 1 to 365 (default: no limit)"},"term":{"type":"string","description":"An IP, IP:port, domain, URL or hash to look for (required)"},"exact":{"type":"string","description":"true for exact match only (default false: partial match)"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_Q7GxewqCtfohyRhN5w4Lg","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Searches abuse.ch ThreatFox for indicators of compromise (IPs, domains, URLs, hashes) returning IOC details, malware family, threat type, confidence score, first/last seen, and Malpedia link.","exampleAgentPrompt":"Can you check ThreatFox on abuse.ch to see if the IP 185.220.101.45 is a known indicator of compromise — I want to know the malware family, threat type, and confidence score, and only show results from the last 90 days.","exampleUseCases":[{"title":"Triage suspicious IP from firewall logs","prompt":"I've got an IP address 45.142.212.100 showing up repeatedly in our firewall logs — can you search ThreatFox to see if it's a known malicious indicator, and tell me what malware family and threat type it's associated with?"},{"title":"Validate file hash before executing","prompt":"Before I run this file, can you check ThreatFox for the SHA256 hash a3f1c2d9e7b4056f8a2d3e1c9b7f4056a3f1c2d9e7b4056f8a2d3e1c9b7f4056 and tell me if it's been flagged as malware, including the family and confidence score?"},{"title":"Investigate phishing domain threat intel","prompt":"We received a phishing report mentioning the domain evilpayments-secure.com — please search ThreatFox for it with an exact match and tell me everything: IOC type, malware family, reporter, tags, and when it was first and last seen."}],"resultDescription":"Returns a list of matching IOC records from ThreatFox, each containing: the IOC value and type (e.g. ip:port, domain, url, hash), associated malware family name, threat type (e.g. botnet_cc, payload_delivery), confidence level (0–100), first and last seen timestamps, the reporter's alias, any associated tags, and a Malpedia link for further malware research context.","failureModes":["No results returned if the indicator has never been reported to ThreatFox","Partial matches may return unrelated IOCs if exact=false and the term is short or generic","days parameter out of range (not 1–365) may cause an error or be ignored","Network timeout if the ThreatFox upstream API is slow or unavailable","Malformed input (e.g. invalid hash format or non-ASCII domain) may return an empty result or error"],"whenToPreferThis":"Choose this endpoint when you need structured, curated threat intelligence from abuse.ch ThreatFox specifically — particularly for correlating IPs, domains, URLs, or file hashes against a community-reported malware IOC database with confidence scoring and Malpedia links. Prefer it over generic WHOIS or IP-reputation checks when you need malware family attribution, threat type classification, or reporter provenance. Complements the sibling URLhaus host-check endpoint (which focuses on active malware distribution hosts) by providing broader IOC coverage across multiple threat types.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-25T12:31:22.798Z","isFirstParty":false,"canonicalSlug":"sitecheck-web-intel-threatfox-ioc-lookup-bf3ee5bc"}