Lion Cipher Lab
Operationalize abuse.ch threat feeds (ThreatFox & URLhaus)
- Threat Intel Analyst
- Intermediate
- ~45 min
- Free · no account required
Why it matters
Threat intelligence is only worth anything when it changes what your defenses do. A feed you read once and forget is a newsletter; a feed that feeds your firewall, proxy, or EDR is intelligence. abuse.ch runs some of the best free, community-curated feeds on the internet — ThreatFox for indicators of compromise and URLhaus for malware-distribution URLs — and this lab takes you the whole distance: from a free account and an API key, to a real query, to a Python script that pulls the data, de-dupes it, filters it by confidence, and exports a blocklist a real defense tool could ingest. Just as…
What you'll learn
- consuming threat feeds
- IOC management
- ThreatFox API
- URLhaus
- building a blocklist
- confidence tiering & dedup
- Python
Steps in this lab
- What these feeds are — and the one safety rule you never break
- Create a free abuse.ch account and get your Auth-Key
- Query ThreatFox by hand first (so you know what 'good' looks like)
- Query URLhaus for recent malicious URLs
- Write the script: pull, de-dupe, filter by confidence, export
- The judgment call: why you don't just block everything
- Level up: from a flat file to a real TIP