"abuse.ch" matching MCP servers:

Enables querying threat intelligence data about files, URLs, IPs, and domains from multiple abuse.ch platforms (MalwareBazaar, URLhaus, and ThreatFox) through a unified API. Provides comprehensive security reports and threat analysis data for cybersecurity investigations.

Enables querying the abuse.ch MalwareBazaar database for malware samples by tag, family, signature, or recent submissions.

Feodo Tracker MCP providing botnet C&C IP blocklist from abuse.ch, enabling querying of current blocklists, IP checks, and recent entries.

Wraps abuse.ch URLhaus malware URL database (free, no auth) – enables querying malware URLs via natural language through Pipeworx MCP gateway.