threatfox

package
v1.2.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jun 30, 2026 License: MIT Imports: 14 Imported by: 0

Documentation

Overview

Package threatfox adds an abuse.ch ThreatFox IOC lookup to yarad: URLs and domains pulled from a message (and from the decompressed VBA/RTF the extract package surfaces) are checked against a locally-cached feed of recent malicious indicators.

Design mirrors internal/urlhaus (same Auth-Key, same fetch/refresh/cache pattern):

  • The IOC CSV is downloaded once per refresh interval (>=5 min fair-use).
  • A failed refresh keeps the previous set (fail-static).
  • URL and domain IOCs are stored in separate sets; a hit on either is reported with an appropriate rule name.
  • Cheap defanging catches obfuscated URLs (hxxp / [.] / (dot)).
  • Per-message URL count is bounded by maxURLs.

ThreatFox focuses on botnet C&C indicators (post-infection), complementing URLhaus's delivery-URL focus. The same abuse.ch Auth-Key (free account at https://auth.abuse.ch/) works for both services. When no key is supplied, New returns nil (feature disabled).

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type Checker 

type Checker struct {
	// contains filtered or unexported fields
}

Checker holds the cached feed and serves lookups.

func New 

func New(key string, refresh time.Duration, cacheDir string, logf func(string, ...any)) *Checker

New builds a Checker and starts its background refresher. Returns nil when key is empty (feature disabled). refresh is clamped to the fair-use floor.

func (*Checker) Check 

func (c *Checker) Check(data []byte, maxURLs int) []Hit

Check extracts URLs from data (and from a cheaply-defanged copy) via urlcand.Extract, looks each up in the feed, and returns the matches. maxURLs bounds work per buffer. Delegates to CheckCandidates.

func (*Checker) CheckCandidates 

func (c *Checker) CheckCandidates(cands []urlcand.Candidate, maxURLs int) []Hit

CheckCandidates looks up pre-extracted URL candidates in the feed. cands is produced by urlcand.Extract; maxURLs caps how many candidates are processed.

func (*Checker) Close 

func (c *Checker) Close()

Close stops the background refresher. Safe on nil and multiple calls.

func (*Checker) Metrics 

func (c *Checker) Metrics() Metrics

Metrics returns a snapshot for /metrics.

type Hit 

type Hit struct {
	URL   string // matched (normalized) URL or domain
	Host  bool   // matched at host/domain level rather than exact URL
	Deobf bool   // found only after defanging — more suspicious
}

Hit is one URL or domain in a scanned buffer that matched the ThreatFox feed.

func (Hit) Rule 

func (h Hit) Rule() string

Rule returns the synthetic rule name for a hit.

type Metrics 

type Metrics struct {
	Enabled         bool
	FeedURLs        int64
	FeedDomains     int64
	LastRefreshUnix int64
	RefreshFailures uint64
	Lookups         uint64
	Hits            uint64
}

Metrics is a snapshot for /metrics.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.