Threat-intelligence feed
Malware DistributionLast verified Page fetched
MalwareBazaar Recent is a malware distribution threat-intelligence feed tracked by WhisperGraph as a FEED_SOURCE node. The Whisper Internet Directory publishes this page so security analysts and LLM agents can link to it as a stable record for MalwareBazaar Recent.
MalwareBazaar Recent is the rolling-window malware-distribution feed published by abuse.ch as part of the MalwareBazaar project. It enumerates domains and URLs observed serving malware payloads — droppers, loaders, second-stage executables, and packed binaries — sourced from sandbox runs, partner submissions, and direct VirusTotal pivots. Each entry carries a sample SHA256, a malware family tag, and a first-seen timestamp; the recent view rolls older entries off so the list reflects currently-live distribution infrastructure rather than archival material. It is indexed here because MalwareBazaar is one of the most widely-cited free malware-IOC repositories in 2026 incident reports.
FEED_SOURCE node not currently in WhisperGraph. The editorial entry for MalwareBazaar Recentis committed to the directory but the corresponding graph node is missing — typically a transient state during the threat-feed import pipeline's between-runs window. The page will reconcile on the next revalidation.
Indicators: Computing — check back later. The precompute pipeline is building this feed's indicator sample from the host corpus and will populate the count and representative addresses on an upcoming run.
Look up which threat feeds list a given IP — the indicator-anchored query that powers the threat card:
MATCH (ip:IPV4 {name: $ip})-[:LISTED_IN]->(f:FEED_SOURCE)
WHERE f.name = "MalwareBazaar Recent"
WITH f
MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
RETURN f.name AS feed, c.name AS categoryVerify the feed's graph-side identity directly:
MATCH (f:FEED_SOURCE {name: "MalwareBazaar Recent"})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
RETURN f.id AS id, f.name AS name, c.name AS categoryOr query Whisper from your own LLM workflow via the Whisper MCP server.
Pivot from MalwareBazaar Recent into adjacent entities.