# Threat Intel IOC Feed Aggregator (`jungle_synthesizer/threat-intel-ioc-feed-aggregator-scraper`) Actor Normalizes and dedupes six free IOC feeds (URLhaus, Feodo Tracker, ThreatFox, MalwareBazaar, OpenPhish, PhishTank) into one schema with cross-feed corroboration counts. Delta mode returns only newly-seen indicators since your last run. Passive: reads published feeds only, never touches listed IOCs. - **URL**: https://apify.com/jungle\_synthesizer/threat-intel-ioc-feed-aggregator-scraper.md - **Developed by:** [BowTiedRaccoon](https://apify.com/jungle_synthesizer) (community) - **Categories:** Developer tools, Automation - **Stats:** 2 total users, 1 monthly users, 91.7% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing Pay per event This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js/docs.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python/docs.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## Threat Intel IOC Feed Aggregator Normalizes and cross-feed-dedupes **six free, published threat-intelligence IOC feeds** into one schema, with a cross-feed corroboration count and a persisted delta cursor for hourly-poll blocklist/enrichment pipelines. Built for SOC/blue-team, detection-engineering, and threat-intel teams that currently pull each free feed separately in its own raw format and stitch them together by hand. **Passive by design.** This actor reads the published feed *endpoints* only (`urlhaus.abuse.ch`, `feodotracker.abuse.ch`, `threatfox.abuse.ch`, `bazaar.abuse.ch`, `openphish.com`, `data.phishtank.com`). It never connects to, resolves, or scans any of the malicious infrastructure *listed inside* those feeds — the URLs/IPs/hashes being cataloged are parsed as inert text only. --- ### Covered Feeds | Source | Feed | IOC Type | Auth Required | |--------|------|----------|----------------| | `urlhaus` | [abuse.ch URLhaus](https://urlhaus.abuse.ch/) — recent malware-distribution URLs | `url` | None | | `feodo` | [abuse.ch Feodo Tracker](https://feodotracker.abuse.ch/) — active botnet C2 IPs | `ip_port` | None | | `threatfox` | [abuse.ch ThreatFox](https://threatfox.abuse.ch/) — recent multi-type IOCs | `url` / `domain` / `ip_port` / hashes | None | | `malwarebazaar` | [abuse.ch MalwareBazaar](https://bazaar.abuse.ch/) — recent malware sample hashes | `sha256_hash` | None | | `openphish` | [OpenPhish](https://openphish.com/) — public phishing URL feed | `url` | None | | `phishtank` | [PhishTank](https://www.phishtank.com/) — verified online phishing URLs | `url` | None | All six feeds are free, published downloads. None require an account or API key for the endpoints this actor uses. --- ### Input | Field | Type | Default | Description | |-------|------|---------|-------------| | `sources` | array | all six | Subset of feeds to fetch and merge: `urlhaus`, `feodo`, `threatfox`, `malwarebazaar`, `openphish`, `phishtank` | | `maxItems` | integer | 15 | Maximum normalized IOC records to return this run, across all selected feeds combined | | `resetState` | boolean | false | Force this run to treat all currently-listed IOCs as new, ignoring the persisted delta cursor. Use once for a full baseline pull | #### Delta mode (default behavior) Every run persists the set of IOC keys it has already emitted (in the actor's key-value store, pruned after 30 days). On each subsequent run, only IOCs **not previously emitted** are returned — so a scheduled hourly run naturally becomes a "what's new since last time" feed instead of re-delivering the same records. If a run is capped by `maxItems` before covering all new IOCs, the remainder carries forward and surfaces on the next run — nothing is dropped, just paginated across runs. Set `resetState: true` for a one-time full snapshot of everything currently in the selected feeds (e.g. for an initial bulk load), then leave it `false` for ongoing polling. --- ### Output Each record contains: | Field | Type | Description | |-------|------|-------------| | `ioc_value` | string | The indicator itself — URL, domain, `ip:port`, or file hash, depending on `ioc_type` | | `ioc_type` | string | `url` \| `domain` \| `ip_port` \| `md5_hash` \| `sha256_hash` \| `sha1_hash` | | `threat_type` | string | `malware_download` \| `botnet_c2` \| `phishing` \| `payload_delivery` | | `malware_family` | string | Malware family / signature name, when known | | `source_feed` | string | Primary reporting feed for this IOC | | `confidence` | integer | Normalized 0-100 confidence score | | `first_seen` | string | Timestamp first reported (earliest across corroborating feeds) | | `last_seen` | string | Timestamp last confirmed active (latest across corroborating feeds) | | `reference_url` | string | Link to the source feed's report page for this indicator | | `tags` | array | Merged tags/labels from all corroborating feeds | | `reporter` | string | Reporting analyst/organization, when the source feed provides one | | `is_online` | boolean | Whether the indicator was reported as currently active/online | | `dedup_source_count` | integer | Number of distinct feeds that independently reported this same indicator | | `scraped_at` | string | ISO timestamp this run fetched the source feeds | A `dedup_source_count` of 2+ means multiple independent feeds corroborated the same indicator — useful as a confidence signal on top of each feed's own scoring. --- ### Example Inputs **Hourly-poll delta (recommended for scheduled runs):** ```json { "maxItems": 500, "sp_intended_usage": "Hourly blocklist enrichment feed", "sp_improvement_suggestions": "None" } ```` **One-time full baseline of just the malware-hash feeds:** ```json { "sources": ["malwarebazaar", "threatfox"], "maxItems": 5000, "resetState": true, "sp_intended_usage": "Initial IOC database seed", "sp_improvement_suggestions": "None" } ``` **Phishing-only feed for a browser-extension blocklist:** ```json { "sources": ["openphish", "phishtank"], "maxItems": 1000, "sp_intended_usage": "Phishing URL blocklist", "sp_improvement_suggestions": "None" } ``` *** ### Data Sources All data is sourced from free, published threat-intelligence feeds: - [abuse.ch](https://abuse.ch/) — URLhaus, Feodo Tracker, ThreatFox, MalwareBazaar (CC0 / free public feeds) - [OpenPhish](https://openphish.com/) — public phishing feed - [PhishTank](https://www.phishtank.com/) — Cisco Talos community phishing verification This actor performs no scanning, resolution, or connection to any indicator it catalogs — it only downloads and normalizes the published feed files. # Actor input Schema ## `sp_intended_usage` (type: `string`): Please describe how you plan to use the data extracted by this crawler. ## `sp_improvement_suggestions` (type: `string`): Provide any feedback or suggestions for improvements. ## `sp_contact` (type: `string`): Provide your email address so we can get in touch with you. ## `sources` (type: `array`): Subset of feeds to fetch and merge. Empty = all six. ## `maxItems` (type: `integer`): Maximum normalized IOC records to return this run, across all selected feeds combined. ## `resetState` (type: `boolean`): Force this run to treat all currently-listed IOCs as new (ignores the persisted 'already seen' cursor from prior runs). Use for a one-time full baseline pull. ## Actor input object example ```json { "sp_intended_usage": "Describe your intended use...", "sp_improvement_suggestions": "Share your suggestions here...", "sp_contact": "Share your email here...", "sources": [], "maxItems": 15, "resetState": false } ``` # Actor output Schema ## `results` (type: `string`): No description # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "sp_intended_usage": "Describe your intended use...", "sp_improvement_suggestions": "Share your suggestions here...", "sp_contact": "Share your email here...", "sources": [], "maxItems": 15, "resetState": false }; // Run the Actor and wait for it to finish const run = await client.actor("jungle_synthesizer/threat-intel-ioc-feed-aggregator-scraper").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "sp_intended_usage": "Describe your intended use...", "sp_improvement_suggestions": "Share your suggestions here...", "sp_contact": "Share your email here...", "sources": [], "maxItems": 15, "resetState": False, } # Run the Actor and wait for it to finish run = client.actor("jungle_synthesizer/threat-intel-ioc-feed-aggregator-scraper").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "sp_intended_usage": "Describe your intended use...", "sp_improvement_suggestions": "Share your suggestions here...", "sp_contact": "Share your email here...", "sources": [], "maxItems": 15, "resetState": false }' | apify call jungle_synthesizer/threat-intel-ioc-feed-aggregator-scraper --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=jungle_synthesizer/threat-intel-ioc-feed-aggregator-scraper", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "Threat Intel IOC Feed Aggregator", "description": "Normalizes and dedupes six free IOC feeds (URLhaus, Feodo Tracker, ThreatFox, MalwareBazaar, OpenPhish, PhishTank) into one schema with cross-feed corroboration counts. Delta mode returns only newly-seen indicators since your last run. Passive: reads published feeds only, never touches listed IOCs.", "version": "0.1", "x-build-id": "s1uszPYxJLL6FttcS" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/jungle_synthesizer~threat-intel-ioc-feed-aggregator-scraper/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-jungle_synthesizer-threat-intel-ioc-feed-aggregator-scraper", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/jungle_synthesizer~threat-intel-ioc-feed-aggregator-scraper/runs": { "post": { "operationId": "runs-sync-jungle_synthesizer-threat-intel-ioc-feed-aggregator-scraper", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/jungle_synthesizer~threat-intel-ioc-feed-aggregator-scraper/run-sync": { "post": { "operationId": "run-sync-jungle_synthesizer-threat-intel-ioc-feed-aggregator-scraper", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "maxItems" ], "properties": { "sp_intended_usage": { "title": "What is the intended usage of this data?", "minLength": 1, "type": "string", "description": "Please describe how you plan to use the data extracted by this crawler." }, "sp_improvement_suggestions": { "title": "How can we improve this crawler for you?", "minLength": 1, "type": "string", "description": "Provide any feedback or suggestions for improvements." }, "sp_contact": { "title": "Contact Email", "minLength": 1, "type": "string", "description": "Provide your email address so we can get in touch with you." }, "sources": { "title": "Feeds to Include", "type": "array", "description": "Subset of feeds to fetch and merge. Empty = all six.", "items": { "type": "string", "enum": [ "urlhaus", "feodo", "threatfox", "malwarebazaar", "openphish", "phishtank" ], "enumTitles": [ "URLhaus (malware URLs)", "Feodo Tracker (botnet C2 IPs)", "ThreatFox (multi-type IOCs)", "MalwareBazaar (malware hashes)", "OpenPhish (phishing URLs)", "PhishTank (phishing URLs)" ] } }, "maxItems": { "title": "Max Records", "type": "integer", "description": "Maximum normalized IOC records to return this run, across all selected feeds combined.", "default": 15 }, "resetState": { "title": "Reset Delta State", "type": "boolean", "description": "Force this run to treat all currently-listed IOCs as new (ignores the persisted 'already seen' cursor from prior runs). Use for a one-time full baseline pull.", "default": false } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```