Changelog

The history of API enhancements and bug fixes.

07/10/2026

• A note on the MalwareBazaar revocations feed: on 08/09/2026 about 23,000 samples were withdrawn in a single step, all with the same revoked_at (2026-09-08T19:17:11Z) and the reason unspecified. These are samples abuse.ch had already marked as false positives at source and that we were still serving; withdrawing them caught up with abuse.ch in one pass rather than reflecting a change in the samples themselves. Integrations polling /malwarebazaar/v1/revocations saw a one-off spike in volume. Paging with after returns every record despite the shared timestamp, so no action is needed; if you capped how many revocations you process per run, check that the backlog has fully drained.
• YARAify is no longer part of the documented API: its endpoints, schemas and references have been removed from the API reference ahead of its withdrawal from the API. Integrations that still query YARAify endpoints should plan to move off them.

01/10/2026

• The Login endpoint now documents API key authentication alongside JWT: generating a key in the Customer Portal, passing it in the URL rather than the Authorization header, and viewing or revoking keys afterwards.
• Corrected the MISP feed export path in the Getting Started authentication table to /<platform>/v2/files/exports/misp/<api-key>/<file-name>; the table previously showed v1.
• Getting Started no longer describes API keys as non-expiring: a key lasts until it is revoked or reaches the expiry date set when it was generated, if any.
• Fixed the ThreatFox file export example in Getting Started, which requested cscb.csv, a MalwareBazaar-only export. It now requests recent.csv.

12/08/2026

• MalwareBazaar withdrawals are no longer permanent. When the abuse.ch curators drop the false-positive listing behind a withdrawal, the sample now returns to service and stops appearing in /malwarebazaar/v1/revocations. This supersedes the note published on 07/08/2026 that a MalwareBazaar withdrawal was effectively final. Reinstatement is deliberately conservative: it needs several separate readings of the false-positive list to agree the listing is gone and hours to have passed, so no single reading can release a sample, and it needs abuse.ch to still serve the sample, so a sample removed from MalwareBazaar altogether stays withdrawn whatever happens to its listing. Reversals are rare in practice.
• As on URLhaus and ThreatFox, no reinstatement signal is published: a reinstated entry simply stops appearing in the revocations feed, so re-synchronise periodically rather than treating a revocation as a permanent verdict. If your integration needs to act on reinstatements, raise it with us — whether to publish them is still open.

06/08/2026

• Fixed the authentication comparison table in Getting Started, whose column headings appeared one column to the left of the values they described.
• Tightened the spacing around the page footer.

07/08/2026

• Fixed the CAPE sandbox link in MalwareBazaar sample responses. vendor_intel.cape.link and the matching file_information entry had the base URL prepended twice, producing a link that could not be followed. Both now return the analysis URL as-is.
• Corrected the documented delivery_method value web_drive to web_drive-by, which is what the API has always returned and what the field description already described.
• MalwareBazaar samples now carry their Spamhaus HBL vendor intelligence again. Enrichment had been failing to run for samples ingested since June, so vendor_intel.spamhaus_hbl was absent from most recent samples; historical samples still listed in HBL have been backfilled.
• New URLhaus endpoint /urlhaus/v1/revocations (and /urlhaus/v2/<api-key>/revocations) lists records URLhaus no longer serves, newest first, so you can withdraw entries you previously ingested. Filter with since and until and page with after, as on the other list endpoints. A revocation means only that the entry has been withdrawn from the dataset — not that the URL was benign or is now safe. Records appear about a minute after being withdrawn, and revocations can be reversed, so overlap your polling window and re-synchronise periodically rather than relying on incremental updates alone.
• New ThreatFox endpoint /threatfox/v1/revocations (and /threatfox/v2/<api-key>/revocations) lists IOCs ThreatFox no longer serves, matching the URLhaus endpoint's shape. Each carries a reason where one is known: absent_upstream (no longer in the community dataset, covering both expiry and false-positive removal, which upstream does not distinguish), removed_by_admin, removed_by_user, or unspecified. As with URLhaus, a revocation means only that the entry has been withdrawn — not that the indicator was benign — records appear about a minute after being withdrawn, and revocations can be reversed, so overlap your polling window and re-synchronise periodically.
• New MalwareBazaar endpoint /malwarebazaar/v1/revocations (and /malwarebazaar/v2/<api-key>/revocations) lists samples MalwareBazaar no longer serves, matching the URLhaus and ThreatFox endpoints' shape. Each record is keyed by sha256_hash and also carries the sample's md5_hash, sha1_hash and sha3_384_hash, so you can retire your own record under whichever hash you ingested it by. The reason is false_positive where the abuse.ch curators listed the sample as one — meaning the file was judged not to be malicious — or unspecified where no reason was recorded. This differs from ThreatFox deliberately: MalwareBazaar records false-positive removals distinctly rather than conflating them with expiry. As on the other platforms, records appear about a minute after being withdrawn and revocations can be reversed, so overlap your polling window and re-synchronise periodically.
• The revocation endpoints now state plainly what they do and do not promise. For URLhaus and ThreatFox: we tell you when a record is withdrawn, and we do not tell you when a withdrawal was wrong — a record reinstated after an incorrect withdrawal simply stops appearing in the revocations feed, and an incremental poll of the main feed misses it because that feed is ordered by when a record was added, so re-synchronise fully rather than treating a revocation as a permanent verdict. For MalwareBazaar the position is different and now says so: a withdrawal there is effectively final, because nothing currently returns a withdrawn sample to service. No behaviour has changed — this documents limitations that were previously easy to miss.

29/07/2026

• URL-path API key authentication now covers ThreatFox, MalwareBazaar and YARAify as well as URLhaus. Query endpoints on all four platforms accept the key first, for example /threatfox/v2/<api-key>/iocs, /malwarebazaar/v2/<api-key>/samples and /yaraify/v2/<api-key>/tasks.
• Sample downloads gain the same URL-path authentication for MalwareBazaar and YARAify, at /malwarebazaar/v2/files/samples/<api-key>/<sha256> and /yaraify/v2/files/samples/<api-key>/<sha256>. ThreatFox has no sample-download endpoint.
• All existing v1 endpoints are unchanged.

28/07/2026

• URLhaus endpoints can now be called with your API key supplied as a URL path segment, for example /urlhaus/v2/<api-key>/urls. Use these variants when your tooling can only be configured with a URL and cannot set HTTP headers — for example Microsoft Defender XDR custom detection rules using KQL externaldata. Because the key appears in the URL it will be recorded in proxy and browser logs, so prefer the header-authenticated endpoints where your tooling supports them.
• Sample downloads accept the same URL-path authentication at /urlhaus/v2/files/samples/<api-key>/<sha256>.
• All existing endpoints are unchanged. ThreatFox, MalwareBazaar and YARAify equivalents will follow.

08/07/2026

• This documentation site has a new home: abusech-docs.spamhaus.com. Please update any bookmarks pointing at the previous address.
• Fixed an issue where the documentation root could serve the raw OpenAPI document to browsers instead of the rendered API reference.

01/07/2026

• Added until query parameter to complement since on list & search endpoints across all platforms (URLhaus, ThreatFox, MalwareBazaar, YARAify), enabling bounded timeframe ranges. Supplying an until earlier than since returns a 400 status.
• Removed the non-functional since parameter from the MalwareBazaar YARA rule-matches endpoint.

13/10/2025

• Fixed bug in URLhaus where tags field was omitted from response when searching URL by ID instead of the full URL.
• Corrected tag filter example in URLhaus URL search endpoint to a valid tag.
• More performance enhancements across all platforms.

08/10/2025

• Fixed bug in ThreatFox IoCs list endpoint (i.e. no search filter query params provided to search endpoint) where records were not correctly ordered by first_seen.
• Fixed bug in URLhaus “search URLs” and “search payloads” endpoints where zero results would return a 500 status instead of a 404 status with empty list.
• Fixed data lag/availability issue in ThreatFox — latest IoCs should now be available as expected.
• Platform-wide performance improvements, substantially reducing request latency.

22/09/2025

• Added since query param to filter results from list & search endpoints across all platforms. The Malware Bazaar max_age param has been replaced with since.

12/09/2025

• Backfilled additional historical ThreatFox and URLhaus data.
• Backwards-compatible change to the SIA login path to be consistent with the other APIs, i.e. both /v1/login and /api/v1/login paths can be used (though the former is now preferred and encouraged in the documentation).
• Rewrote introduction page and corrected contact links.
• Internal bug fixes & OpenAPI specification polishing.
• Created this changelog!