Skip to content
Osint Daily
SponsoredOctoProbe house ad, 300 by 250 pixels, published 16 Oct 2026. Still frame of the square with the OctoProbe wordmark and the line One workspace for the investigation.
Osint Daily cover for ThreatFox, under Threat intelligence, published 16 Oct 2026. The right side crops the listing capture. abuse.ch IOC sharing. Statistics page opened.

01 · Product name

ThreatFox

abuse.ch IOC sharing. Statistics page opened.

Published by abuse.ch and Spamhaus.

Free and paidAPIThreat intelligence

In short

ThreatFox is the indicator project abuse.ch and Spamhaus operate. On 22 Oct 2026 the about page said it collects and shares indicators of compromise. The past-14-days statistics view said the chart is IOCs shared per day over 30 days, and the type table began 6'243 url. The API page says the community API is free under fair use and that commercial use may require the enhanced API. No dollar and no SPDX field were printed. The browse page stopped on a browser check. An IOC is a lead.

Website

Product pricing strategy

02

Free and paid

The ThreatFox community API page, opened 22 Oct 2026, says this API is free of charge under the fair use principles, and that commercial or for-profit use may require a paid subscription for the enhanced abuse.ch commercial API. No dollar amount was printed. No SPDX field was printed on the about page, the statistics page, or the API page. The words free of charge apply to the community API under fair use. They do not name a license. The March 2021 launch line is a date on the Overall tab. It is not a price. The 6'243 figure is a 14-day type count. It is not a fee. A vendor who wants the commercial API is sent onward by that page. This listing does not invent the subscription number the page left out.

Utility and features

03

https://threatfox.abuse.ch/about/ says ThreatFox is operated by abuse.ch and Spamhaus to collect and share indicators of compromise. That page also prints the Spamhaus partnership paragraph that the URLhaus about page prints, including the 4.5 billion mailbox sentence and the 11.7 million IOC sentence. Those figures stay Spamhaus's. They are not a ThreatFox total, and this listing does not paste the paragraph again.

  • 14-day table starts at 6'243. The past-14-days type table listed 6'243 url for command and control, then 5'160 sha256_hash payloads.
  • Overall starts at 801'459. The Overall tab text began 801'459 sha256_hash and dated the project to its launch in March 2021. That tab is not the screenshot.
  • Expiry since 2025-05-01. The API page says IOCs older than 6 months leave the API and the export and stay searchable in the UI as expired.

The statistics page opened. On the past-14-days view the chart sentence says the chart documents IOCs shared per day over a period of 30 days. The type table on that view, with the page's apostrophe thousands separator, began 6'243 url for command and control, 5'160 sha256_hash payload, 4'732 domain payload, and 2'739 ip:port for command and control. The Overall tab's text, captured the same day and not the frame in the screenshots, says IOCs have been submitted since it's launch in March 2021, and its type table began 801'459 sha256_hash. The API page says that since 2025-05-01 IOCs older than 6 months are expired: they are not on the API or the export, and they remain searchable in the UI flagged as expired. The browse URL stopped on a browser check and is not a result page.

  1. 1

    Cite 6'243 from the past-14-days table and 801'459 from the Overall tab. Do not add them.

  2. 2

    Say the chart sentence is 30 days and the type-table heading is past 14 days.

  3. 3

    Treat an IOC as a lead. Do not turn a row into a contact procedure.

Caveats

04

The past-14-days table and the Overall table are different counts. 6'243 url is the 14-day command-and-control URL row. 801'459 sha256_hash is the Overall payload row. Adding them, or calling the 14-day chart a picture of the Overall totals, mixes two tabs. The chart sentence says 30 days. The table heading says past 14 days. Quote the heading you mean. The screenshots are the 14-day chart and the 14-day type table.

The browse page did not get past a browser check. Do not describe a browse row. Expired IOCs, the API page says, dropped off the API and the export on 2025-05-01 when they were older than 6 months, and they can still appear in the UI with an expired flag. An indicator is a lead for someone defending a network they hold. It is not a procedure for contacting a server.

Screenshots

05

ThreatFox IOC chart, past 14 days. Statistics page at https://threatfox.abuse.ch/statistics/ on 22 Oct 2026. The past-14-days view says the chart documents IOCs shared per day over a period of 30 days. No peak day is read off the chart. Captured 2026-10-22. Source
ThreatFox IOC types, past 14 days. The same statistics page on 22 Oct 2026, scrolled to the past-14-days type table. The first rows are 6'243 url, 5'160 sha256_hash, 4'732 domain, and 2'739 ip:port. The Overall tab is not this frame. Captured 2026-10-22. Source

Potential use cases

06

  • The 14-day table and the Overall table are about to be added. On 22 Oct 2026 the past-14-days type table began 6'243 url for command and control, then 5'160 sha256_hash. The Overall tab text began 801'459 sha256_hash and said the project launched in March 2021. The screenshots are the 14-day chart and the 14-day table. Do not add the two tabs.
  • The chart window is about to be renamed. The chart sentence says IOCs shared per day over a period of 30 days. The table heading says past 14 days. Both sentences are on the past-14-days view. Quote the heading you mean. This review did not invent a peak day from the chart image.
  • An expired indicator is about to be treated as absent. The API page says that since 2025-05-01 IOCs older than 6 months leave the API and the export and remain searchable in the UI flagged as expired. The community API is free under fair use. No dollar and no SPDX field were printed. The browse page stopped on a browser check.

Hard cases

The case where the first result is easy to over-read.

6'243 is called the all-time URL count

6'243 is the past-14-days command-and-control URL row, printed with an apostrophe as the thousands separator. 801'459 is the Overall sha256_hash row. A sentence that uses the smaller number as the size of ThreatFox since March 2021 contradicts the Overall tab.

Practitioners using it

Posts on X from people describing a concrete use. The quote is the post. Likes and reposts are the counts saved with it, not a live total. A label marks a creator, a maintainer, a vendor, a partner, a data partner, or an investor.

Partner

Questions

Is ThreatFox free?

The community API page says it is free under fair use. Commercial or for-profit use may require the enhanced API. No dollar price and no SPDX field were printed on 22 Oct 2026.

What did the statistics page show for the last 14 days?

The type table began 6'243 url, 5'160 sha256_hash, 4'732 domain, and 2'739 ip:port. The chart sentence says IOCs shared per day over 30 days. The Overall tab is a separate table.

Citations

07

Titled sources. These public pages are what the quotes on this listing come from.

When this listing changes, the letter says so.

Developments in OSINT. Confirm from your inbox before the first issue.

Only for this letter. Privacy

Related tools

Freemium

URLhaus

abuse.ch and Spamhaus malware-URL sharing.

Threat intelligenceAPI
View listing
Freemium

MalwareBazaar

A public exchange for malware samples and their hashes.

Threat intelligenceGUI
View listing