abuse.ch launches unified Hunting Platform

abuse.ch released a unified Hunting Platform consolidating seven threat intelligence feeds plus previously private datasets, with enhanced features across URLhaus, YARAify, ThreatFox, and MalwareBazaar.

abuse.ch, a community-driven threat intelligence provider, has launched a unified Hunting Platform that allows security researchers to query all seven of its distinct threat intelligence platforms from a single interface. The platform consolidates data from URLhaus, MalwareBazaar, ThreatFox, YARAify, Feodo Tracker, SSL Blacklist, and SSLBL Botnet C2 IP Blocklist, while also making previously private datasets publicly accessible for the first time, including Sinkhole data, Malpedia data, and C2Tracker datasets.

The release includes significant feature enhancements across existing platforms. URLhaus now provides payload overviews, on-demand URL rescanning, and hunting alerts similar to MalwareBazaar and ThreatFox. YARAify introduces auto-delete functionality for submitted files, simplified rescanning without resubmission, and API-based YARA rule deployment. ThreatFox adds ASN information and statistics for network-based IOCs, while MalwareBazaar now includes a Bash script parser that automatically extracts payload delivery URLs from malicious shell scripts.

A consolidated False Positive List has been introduced to improve data quality transparency, accessible through both the hunting platform interface and API with CSV or JSON export options. All features remain free of charge, continuing abuse.ch's 15-year commitment to providing actionable community-driven threat intelligence. The organization has indicated additional features are planned for release in coming weeks.

Source reporting: https://abuse.ch/blog/introducing-abuse-ch-hunting-platform