URLhaus

About URLhaus

URLhaus is a threat-intelligence API operated by abuse.ch that provides programmatic access to data on malicious URLs, file hashes, tags, and malware payloads it tracks. It supports queries for recent URL additions, recent payloads, and lookups by URL, host, payload, tag, or malware signature, and also allows downloading collected malware samples individually or in hourly/daily batches.

Each URL record returned includes status (online, offline, or unknown), associated host, date added, threat classification, blacklist status on SURBL and Spamhaus DBL, reporter handle, and tags. Payload records include file hashes (MD5, SHA256, imphash, ssdeep, tlsh), file type and size, malware family signature, first-seen timestamp, a download link, and VirusTotal detection results where available.

Access requires an Auth-Key sent via HTTP header, obtainable free through the abuse.ch Authentication Portal. Requests are made via HTTP GET, with Python3 sample scripts provided for querying and for submitting URLs to URLhaus. The service is intended for users needing automated access to malware URL and payload intelligence, such as security researchers and threat analysts.

Key features

• Query URL, host, payload, tag, and signature information via REST API
• Retrieve recent malware URL additions from the past 3 days (up to 1000 entries)
• Retrieve recent malware payloads seen by URLhaus
• Download malware samples collected from tracked malware URLs
• Download hourly and daily malware batches
• Cross-reference URLs against SURBL and Spamhaus DBL blacklists

Frequently asked questions