Field note: MalwareBazaar's API no longer carries listing-time detection
A short negative result for anyone reconstructing hash lead-time. The VirusTotal ratio recorded when a sample was listed is gone from the query API — zero of forty samples carried it. We're publishing the dead end so you don't have to find it yourself.
We were reconstructing lead-time: not "is this hash malicious today," but "would we have flagged it at first-seen, before coverage caught up." Answering that honestly needs a point-in-time signal — what detection looked like the moment a sample was listed, not what it looks like now that every aggregator has had weeks to ingest it. The obvious source is MalwareBazaar, which records a first-seen date on every sample.
The first-seen date is still there. The listing-time detection ratio is not. Across 40 sampled entries, zero carried the VirusTotal figure that used to be recorded at submission. The query API returns current metadata; the historical detection panel — the one number that would tell you how thin coverage was on the day the sample appeared — is no longer exposed.
The consequence is worth stating plainly, because it's a trap. Score a MalwareBazaar sample "as of first-seen" without that field and you haven't replayed history — you've scored today's evidence and stapled a historical label onto it. Current vendor state reflects today's coverage, so the result looks like strong retroactive recall when it's really just present-day agreement. You can still get real value from first-seen — lead-time context, and strict-independent recall measured on evidence that doesn't launder the label — but you cannot reconstruct the detection panel as it stood at listing from this API. If you're building hash lead-time work on it, budget for that gap up front.