malware-intel
URLhaus (abuse.ch)
abuse.ch's database of malware-distribution URLs, holding millions of malicious links searchable by URL, host or payload hash. Lookups run through a simple API using the same free abuse.ch Auth-Key as their other services. Check it when you want to know whether a URL found in an archived page or old dataset was known to push malware.
Why it’s useful & how it works
URLhaus focuses specifically on URLs that were actively distributing malware payloads, giving it a different angle from hash repositories: you can trace a suspicious link found in archived content back to known campaigns, or look up a payload hash to find which distribution URLs were serving it. It is run by abuse.ch in partnership with Spamhaus. Queries go through its API using the same free abuse.ch Auth-Key that covers MalwareBazaar and ThreatFox.
What’s inside
URLhaus tracks roughly 3.8 million malicious URLs collected since the project launched in 2018. Each entry records the URL, its current status, associated threat tags and any payload file hashes, giving a longitudinal view of how distribution infrastructure has changed over time.
API access
POST https://urlhaus-api.abuse.ch/v1/ (url=/host=/payload=); header Auth-Key
An API key is required (usually free); see the endpoints above for where to get one.
What we measured
Our own probes, not the archive’s own claims. Re-run periodically; every reading below is dated.
Reachability
- Direct request
- Responded HTTP 200 243 ms
- Through a datacenter proxy
- Responded HTTP 200 725 ms
- API, direct
- Blocked HTTP 401 216 ms
- API, through a proxy
- Blocked HTTP 401 770 ms
Reachability measured 2026-08-22.
Access
Programmatic API access (a key may be required, see the API tag).