# @apiclient.xyz/abuse.ch

> 🛡️ Unofficial TypeScript/JavaScript client for retrieving threat intelligence data from abuse.ch

Access real-time malware URLs, malicious indicators of compromise (IOCs), and botnet C&C servers through a clean, type-safe API.

## Issue Reporting and Security

For reporting bugs, issues, or security vulnerabilities, please visit [community.foss.global/](https://community.foss.global/). This is the central community hub for all issue reporting. Developers who sign and comply with our contribution agreement and go through identification can also get a [code.foss.global/](https://code.foss.global/) account to submit Pull Requests directly.

## What is abuse.ch?

[abuse.ch](https://abuse.ch/) is a community-driven platform operated by a Swiss security researcher that tracks and shares threat intelligence data. This module provides programmatic access to three key abuse.ch services:

- **URLhaus** - Malware URL distribution database
- **ThreatFox** - Indicators of Compromise (IOC) sharing platform
- **FeodoTracker** - Botnet C&C server tracker

## Installation

```bash
npm install @apiclient.xyz/abuse.ch
# or
pnpm install @apiclient.xyz/abuse.ch
```

## Usage

### URLhaus - Retrieve Malicious URLs

```typescript
import { UrlHaus } from '@apiclient.xyz/abuse.ch';

const urlHaus = new UrlHaus();
const maliciousUrls = await urlHaus.getData();

console.log(maliciousUrls[0]);
// {
//   ID: '12345',
//   Dateadded: '2025-01-15 10:30:00',
//   URL: 'http://malicious-example.com/malware.exe',
//   URLStatus: 'online',
//   Threat: 'malware_download',
//   AssociatedTags: 'emotet',
//   UrlHausLink: 'https://urlhaus.abuse.ch/url/12345/',
//   Reporter: 'abuse_ch'
// }
```

### ThreatFox - Access IOC Data

```typescript
import { ThreatFox } from '@apiclient.xyz/abuse.ch';

const threatFox = new ThreatFox();
const iocs = await threatFox.getData();

console.log(iocs[0]);
// {
//   ID: '67890',
//   Dateadded: '2025-01-15 11:45:00',
//   URL: 'http://c2-server.example.com',
//   URLStatus: 'online',
//   Threat: 'botnet_cc',
//   AssociatedTags: 'mirai',
//   ThreatFoxLink: 'https://threatfox.abuse.ch/ioc/67890/',
//   Reporter: 'researcher_name'
// }
```

### FeodoTracker - Track Botnet C&C Servers

```typescript
import { FeodoTracker } from '@apiclient.xyz/abuse.ch';

const feodoTracker = new FeodoTracker();
const c2servers = await feodoTracker.getData();

console.log(c2servers[0]);
// {
//   ip_address: '192.0.2.100',
//   port: 8080,
//   status: 'online',
//   hostname: 'malicious.example.com',
//   as_number: 12345,
//   as_name: 'EXAMPLE-AS',
//   country: 'US',
//   first_seen: '2025-01-10',
//   last_online: '2025-01-15',
//   malware: 'Emotet'
// }
```

## TypeScript Support

This module is written in TypeScript and provides full type definitions out of the box. All data structures are properly typed for maximum developer productivity and type safety.

```typescript
import type {
  IUrlHausData,
  IThreatFoxData,
  IFeodoTrackerData
} from '@apiclient.xyz/abuse.ch';
```

## Proxy Support

The client automatically detects and uses proxy settings from your environment variables (`HTTP_PROXY`, `HTTPS_PROXY`) when making requests to abuse.ch APIs.

## Features

✅ **Type-safe** - Full TypeScript support with comprehensive interfaces
✅ **Modern** - Uses ES modules and async/await patterns
✅ **Lightweight** - Minimal dependencies, focused functionality
✅ **Proxy-aware** - Automatic proxy detection and configuration
✅ **Reliable** - Fetches data directly from official abuse.ch sources

## API Rate Limits

Please be respectful of abuse.ch's resources. The service is provided free of charge by the security community. Avoid excessive polling and cache results when possible.

## Links

- [npm package](https://www.npmjs.com/package/@apiclient.xyz/abuse.ch)
- [abuse.ch official website](https://abuse.ch/)
- [URLhaus](https://urlhaus.abuse.ch/)
- [ThreatFox](https://threatfox.abuse.ch/)
- [FeodoTracker](https://feodotracker.abuse.ch/)

## License and Legal Information

This repository contains open-source code that is licensed under the MIT License. A copy of the MIT License can be found in the [license](license) file within this repository.

**Please note:** The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.

### Trademarks

This project is owned and maintained by Task Venture Capital GmbH. The names and logos associated with Task Venture Capital GmbH and any related products or services are trademarks of Task Venture Capital GmbH and are not included within the scope of the MIT license granted herein. Use of these trademarks must comply with Task Venture Capital GmbH's Trademark Guidelines, and any usage must be approved in writing by Task Venture Capital GmbH.

### Company Information

Task Venture Capital GmbH
Registered at District court Bremen HRB 35230 HB, Germany

For any legal inquiries or if you require further information, please contact us via email at hello@task.vc.

By using this repository, you acknowledge that you have read this section, agree to comply with its terms, and understand that the licensing of the code does not imply endorsement by Task Venture Capital GmbH of any derivative works.