Data sources

Every source is queried in parallel and weighted by how strongly it asserts a verdict. Sources marked context add enrichment only — they never change the verdict.

Source	Supports	Category	Auth	Status
CIRCL hashlookup circl	hash	reputation	none	active
AlienVault OTX otx	hash	reputation	none	active
MalwareBazaar (abuse.ch) malwarebazaar	hash	reputation	ABUSECH_AUTH_KEY	active
ThreatFox (abuse.ch) threatfox	hash, url, domain, ip	reputation	ABUSECH_AUTH_KEY	active
URLhaus payload (abuse.ch) urlhaus	hash	reputation	ABUSECH_AUTH_KEY	active
VirusTotal (files) virustotal	hash	reputation	VT_API_KEY	needs key
Hybrid Analysis hybridanalysis	hash	reputation	HA_API_KEY	needs key
MalShare malshare	hash	reputation	MALSHARE_API_KEY	needs key
Hatching Triage triage	hash	reputation	TRIAGE_API_KEY	needs key
AlienVault OTX (URL) otx_url	url	reputation	none	active
urlscan.io (URL) urlscan	url, domain, ip	reputation	none	active
URLhaus (URL) urlhaus_url	url	reputation	ABUSECH_AUTH_KEY	active
VirusTotal (URL) virustotal_url	url	reputation	VT_API_KEY	needs key
Google Safe Browsing gsb	url, domain	reputation	GSB_API_KEY	needs key
PhishTank phishtank	url	reputation	PHISHTANK_APPKEY	needs key
AlienVault OTX (domain) otx_domain	domain, ip	reputation	none	active
VirusTotal (domain/IP) virustotal_domain	domain, ip	reputation	VT_API_KEY	needs key
DNS records dns	domain, ip	intel	none	active
WHOIS / RDAP rdap	domain, ip	intel	none	active
Certificate Transparency crt	domain	intel	none	active
Reverse IP reverseip	domain, ip	intel	none	opt-in

Enabling keyed sources

Set the environment variable and restart the service. Keys are never sent to the browser or logged.

# /etc/threattrove/threattrove.env
ABUSECH_AUTH_KEY=...      # auth.abuse.ch — MalwareBazaar, ThreatFox, URLhaus
VT_API_KEY=...            # virustotal.com — files, URLs, domains, IPs
OTX_API_KEY=...           # otx.alienvault.com (optional, raises limits)
URLSCAN_API_KEY=...       # urlscan.io (optional, raises limits)
HA_API_KEY=...            # hybrid-analysis.com
MALSHARE_API_KEY=...      # malshare.com
TRIAGE_API_KEY=...        # tria.ge
GSB_API_KEY=...           # Google Safe Browsing v4
PHISHTANK_APPKEY=...      # phishtank.com

The free sources (CIRCL hashlookup, AlienVault OTX, urlscan.io search, DNS, RDAP and Certificate Transparency) answer without any key, so a fresh install is useful immediately. Reverse IP lookups are free but rate limited, so they stay off until you set TT_ENABLE_REVERSE_IP=1.