{"slug":"api-webintel-api-workers-dev-api-security-threatfox-iocs-789e94","title":"Searches abuse.ch ThreatFox for indicators of compromise matching a term (IP, IP","host":"api.webintel-api.workers.dev","method":"GET","resource":"https://api.webintel-api.workers.dev/api/security/threatfox-iocs","category":"other","description":"Searches abuse.ch ThreatFox for indicators of compromise matching a term (IP, IP:port, domain, URL or file hash): IOC, type, malware family, threat type, confidence, first/last seen, reporter, tags and Malpedia link. Optional exact match and a first-seen window in days.","price_listed":0.002,"price_asked":0.002,"state":"answering","state_label":"Answering","checks_7d":1,"answered_7d":1,"latency_ms_median":35,"reported_calls_30d":1,"reported_payers_30d":1,"networks":["eip155:5042","eip155:8453","solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp","xrpl:0"],"badge":"unverified","paid_checks_7d":0,"paid_ok_7d":0,"example_input":{"method":"GET","queryParams":{"exact":"true","term":"ilmanlaatu.toutestbleu.info"},"type":"http"},"output_schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"input":{"additionalProperties":false,"properties":{"method":{"enum":["GET"],"type":"string"},"queryParams":{"properties":{"days":{"description":"Only IOCs first seen in the last N days, 1 to 365 (default: no limit)","type":"string"},"exact":{"description":"true for exact match only (default false: partial match)","type":"string"},"term":{"description":"An IP, IP:port, domain, URL or hash to look for (required)","type":"string"}},"required":["term"],"type":"object"},"type":{"const":"http","type":"string"}},"required":["type","method"],"type":"object"},"output":{"properties":{"example":{"type":"object"},"type":{"type":"string"}},"required":["type"],"type":"object"}},"required":["input"],"type":"object"},"history":[{"day":"2026-10-24","reachable":true,"status":402,"valid_402":true,"asked_usdc":0.002,"price_match":true,"latency_ms":35,"error":null}],"description_full":"Searches abuse.ch ThreatFox for indicators of compromise matching a term (IP, IP:port, domain, URL or file hash): IOC, type, malware family, threat type, confidence, first/last seen, reporter, tags and Malpedia link. Optional exact match and a first-seen window in days.","last_updated":"2026-10-23T18:42:33.621Z","schemes":["exact"]}