URLhaus: Threat Feeds, API Queries and Analysis

Who this is for: Cybersecurity researchers, threat intelligence analysts, and academic computer science investigators studying malware distribution, botnet infrastructure, and automated threat feeds.

What you will be able to do: Query URLhaus programmatically via REST API, ingest real-time threat intelligence feeds in CSV and JSON formats, parse malware delivery telemetry, and integrate threat indicators into research environments like MISP and OpenCTI.

What it is used for in research

URLhaus is an open, community-driven cyber threat intelligence platform operated by abuse.ch in collaboration with Spamhaus. Its dedicated purpose is collecting, tracking, analyzing, and sharing malicious URLs actively used for malware distribution. While broad threat repositories track heterogeneous indicators of compromise (IoCs), URLhaus concentrates strictly on the delivery tier of malware campaigns—the specific network endpoints, infected websites, and staging servers hosting malicious payloads.

In academic and institutional cybersecurity research, URLhaus provides empirical ground truth for studying adversarial distribution tactics. Researchers rely on URLhaus telemetry to investigate several core problems in threat intelligence and defensive engineering:

Payload Staging and Hosting Infrastructure: Measuring how adversaries leverage compromised content management systems, bulletproof hosters, and open cloud storage buckets to distribute initial-access loaders, trojans, infostealers, and ransomware payloads.
Autonomous System Churn: Tracking the concentration and migration of malicious URLs across Autonomous System Numbers (ASNs) and geographic IP allocations over time.
Correlation with Binary Repositories: Bridging the gap between network-level delivery URLs and binary artifact analysis by correlating URLhaus URL records with binary samples in MalwareBazaar.
Downstream Ecosystem Protection: Feeding verified distribution indicators into defensive networks. High-confidence indicators shared on URLhaus flow directly into major filtering systems, including the Spamhaus Domain Blocklist (DBL), SURBL, and Google Safe Browsing (GSB).
Empirical Telemetry for Open Science: Providing reproducible dataset snapshots under open data sharing principles, allowing researchers to benchmark detection algorithms and threat correlation pipelines.

Install or access (official source only)

URLhaus operates as a hosted public service accessible through web and programmatic interfaces. Researchers do not need to compile or deploy local server software to access data.

Web Interface: The primary portal is hosted at https://urlhaus.abuse.ch/. Users can browse recent malware URL submissions, inspect statistics, and query specific domains, IP addresses, or file hashes.
REST API: The URLhaus Bulk API is served from https://urlhaus-api.abuse.ch/v1/. All endpoints accept standard HTTP requests and return structured JSON responses.
Authentication Key (Auth-Key): Accessing the API and downloading data feeds requires an authenticating key. Researchers must create a free account at the official abuse.ch Authentication Portal (https://auth.abuse.ch/) and generate an Auth-Key. Every API query must transmit this key via the Auth-Key HTTP request header.
Data Feeds and Dumps: Pre-generated database dumps are published in CSV and JSON formats. These include full exports (URLs active or added within the past 90 days), active-only feeds, and 30-day rolling exports. Dumps are generated every 5 minutes at https://urlhaus-api.abuse.ch/v2/files/exports/YOUR-AUTH-KEY-HERE/recent.csv. Downstream scripts must respect this 5-minute interval and refrain from higher-frequency polling.
Specialized Export Formats: In addition to CSV and JSON, URLhaus distributes DNS Response Policy Zones (RPZ), Snort and Suricata IDS rulesets, plain-text URL lists, and ClamAV signatures for direct perimeter ingestion.

Step-by-step task

This walk-through demonstrates how to query URLhaus via the REST API to pull recent malware distribution URLs, look up a specific suspect URL, and query payload hashes from a terminal or Python workflow.

Step 1: Obtain and configure your Auth-Key

Register for a free account at the abuse.ch Authentication Portal (https://auth.abuse.ch/). Once authenticated, retrieve your unique API key and export it to your local environment:

export URLHAUS_AUTH_KEY="YOUR_ACTUAL_AUTH_KEY"

Step 2: Query recent malware distribution URLs

To inspect newly reported URLs added over the past 3 days, send an HTTP GET request to the /v1/urls/recent/ endpoint. Use the optional limit parameter to cap the response size (up to 1,000 entries):

curl -s -X GET   -H "Auth-Key: $URLHAUS_AUTH_KEY"   https://urlhaus-api.abuse.ch/v1/urls/recent/limit/5/

Step 3: Query detailed telemetry for a specific URL

To determine whether a specific URL is known to URLhaus and retrieve its operational status and linked payloads, send an HTTP POST request to /v1/url/ with the URL URL-encoded in the POST body:

curl -s -X POST   -H "Auth-Key: $URLHAUS_AUTH_KEY"   --data-urlencode "url=http://malicious-delivery-site.example/payload.exe"   https://urlhaus-api.abuse.ch/v1/url/

Step 4: Query infrastructure by host or domain

To examine all malicious distribution URLs associated with a specific fully qualified domain name (FQDN) or IP address, send an HTTP POST request to /v1/host/:

curl -s -X POST   -H "Auth-Key: $URLHAUS_AUTH_KEY"   --data "host=malicious-delivery-site.example"   https://urlhaus-api.abuse.ch/v1/host/

Step 5: Query by cryptographic payload hash

If you have extracted a binary sample and need to identify the distribution URLs from which it was served, submit the file’s SHA-256 or MD5 hash to /v1/payload/:

curl -s -X POST   -H "Auth-Key: $URLHAUS_AUTH_KEY"   --data "sha256_hash=275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f"   https://urlhaus-api.abuse.ch/v1/payload/

Step 6: Automate query parsing in Python

The following Python 3 script demonstrates how to authenticate, submit a URL lookup request, parse the JSON response, and inspect blacklists and associated payloads:

import os
import requests

auth_key = os.environ.get("URLHAUS_AUTH_KEY")
headers = {
    "Auth-Key": auth_key,
    "User-Agent": "AcademicResearchSensor/1.0"
}

target_url = "http://malicious-delivery-site.example/payload.exe"
endpoint = "https://urlhaus-api.abuse.ch/v1/url/"

response = requests.post(endpoint, data={"url": target_url}, headers=headers, timeout=15)
data = response.json()

if data.get("query_status") == "ok":
    print(f"URLhaus ID: {data.get('id')}")
    print(f"URL Status: {data.get('url_status')}")
    print(f"Host: {data.get('host')}")
    print(f"Date Added: {data.get('date_added')}")
    print(f"Threat Category: {data.get('threat')}")
    
    blacklists = data.get("blacklists", {})
    for list_name, status in blacklists.items():
        print(f"  Blacklist {list_name}: {status}")
        
    payloads = data.get("payloads", [])
    print(f"Associated Payloads: {len(payloads)}")
    for p in payloads:
        print(f"  - SHA256: {p.get('response_sha256')}")
        print(f"    File Type: {p.get('file_type')}, Signature: {p.get('signature')}")
elif data.get("query_status") == "no_results":
    print("URL not currently indexed in URLhaus database.")
else:
    print(f"Query returned error: {data.get('query_status')}")

Output and how to read it

URLhaus API responses are delivered in structured JSON. The top-level key query_status communicates the operational state of the query before any indicator fields are parsed.

Core status and query response fields

query_status: The primary indicator of request validity. Standard return values include ok (query succeeded and data is returned), no_results (the queried indicator was not found in the database), invalid_url (the provided URL string failed structural validation), http_post_expected (the endpoint requires an HTTP POST method), and http_get_expected (the endpoint requires an HTTP GET method).
id: The unique positive integer identifying the URL record in the database.
urlhaus_reference: Direct HTTPS hyperlink to the web report page on https://urlhaus.abuse.ch/url/<id>/.
url: The canonical URL string recorded on the wire during malware delivery.
url_status: The real-time operational status of the malware delivery endpoint. Possible values are:
- online: The malware URL is active, reachable over the network, and currently serving a malicious payload.
- offline: The malware URL is inactive, unreachable, or has been taken down by the host/registrar.
- unknown: The status could not be verified definitively by the URLhaus scanning infrastructure.
host: The extracted network host component, represented as either a domain name/FQDN or a public IPv4/IPv6 address.
date_added: UTC timestamp in YYYY-MM-DD HH:MM:SS UTC format indicating when the URL was first reported.
threat: The primary threat classification. The standard classification for distribution sites is malware_download.
reporter: The pseudonym or handle of the security researcher or automated community sensor that submitted the indicator.

Blacklist indicators and payload telemetry

Each URL record includes a blacklists dictionary detailing multi-vendor reputation status:

surbl: Reputation status in SURBL URI reputation lists (listed or not listed).
spamhaus_dbl: Reputation status in the Spamhaus Domain Blocklist (listed or not listed).
gsb: Detection flag from Google Safe Browsing (listed or not listed).

When URLhaus automated collectors successfully download a binary from an active URL, the response embeds a payloads array. Each payload entry contains the collected binary’s cryptographic hashes (response_md5, response_sha256), HTTP headers (content-type, response_size), and automated classification data (such as Antivirus signatures, ClamAV detections, and linked malware family labels like Cobalt Strike, RedLine Stealer, or Mirai).

Troubleshooting

When developing automated ingestion pipelines, researchers frequently encounter specific edge cases related to authentication, rate limiting, and URL syntax.

Missing or invalid Auth-Key

If your requests return HTTP 401/403 or a query status indicating unauthorized access, verify that the Auth-Key header is present and correctly capitalized. The header name is Auth-Key (not Authorization: Bearer or X-API-Key). Confirm that your key is active in the abuse.ch Authentication Portal.

Database dump polling frequency violations

URLhaus database dumps are compiled every 5 minutes. Pulling exports more frequently than this window consumes unnecessary bandwidth and may trigger automated rate throttling. Always configure local cron tasks or ingest daemons to poll at intervals of 5 minutes or longer, and check the Last-Modified header before performing full data updates.

URL formatting and trailing slashes

URLhaus expects URLs exactly as observed on the wire returning HTTP 200 OK. A common submission error occurs when submitting bare domain roots without trailing slashes. For example, http://malicious.example should be formatted as http://malicious.example/, and query parameters should be preserved (e.g. http://malicious.example/?ref=1). Submitting improperly formed URLs results in an invalid_url status.

Submission policy boundaries (Malware vs. Phishing vs. Adware)

URLhaus maintains strict submission boundaries. Violating these rules repeatedly leads to account suspension:

Phishing is not accepted: Do not submit credential harvesting pages or phishing kits to URLhaus. Report phishing indicators to specialized platforms like APWG, PhishTank, or Netcraft.
Adware/PUPs are excluded: Potentially unwanted programs requiring user licensing agreements are not tracked. Submissions must involve destructive malware binaries, scripts, or loaders.
URL Shorteners: Redirector links (e.g. Bitly) that do not directly host a malicious payload should not be submitted. Only submit the final destination URL that serves the binary.
Private IP addresses: Never submit private IP addresses defined under RFC 1597 / RFC 1918 or special-purpose IP ranges (RFC 6890).

Handling geofenced malware distribution

Adversaries often restrict payload delivery to target jurisdictions using GeoIP filtering, causing automated scanning sensors from other countries to receive HTTP 403 or 404 responses. When submitting a geofenced URL, include the tag geofenced alongside the appropriate three-letter NATO country code (such as GBR for Great Britain or DEU for Germany). URLhaus will dispatch regional collectors to verify and download the payload.

Free alternatives

The following table compares URLhaus with other established open-access threat intelligence and malware tracking platforms used in academic and operational security research:

Platform	Primary Indicator Type	Data Formats	API Access	Best Research Use Case
URLhaus (abuse.ch)	Malicious URLs distributing malware payloads	CSV, JSON, DNS RPZ, Snort/Suricata, ClamAV	Free REST API (Auth-Key required)	Tracking malware drop sites, delivery server lifecycles, and hosting ASN concentrations.
ThreatFox (abuse.ch)	Multi-indicator IoCs (domains, IPs, hashes, C2 ports)	JSON, CSV, MISP, Suricata	Free REST API (Auth-Key required)	Correlating botnet Command-and-Control infrastructure and high-confidence IoCs.
MalwareBazaar (abuse.ch)	Malware binary samples and cryptographic hashes	Raw binaries, JSON, CSV	Free REST API (Auth-Key required)	Acquiring executable binaries for reverse engineering, static analysis, and YARA hunting.
OpenPhish	Phishing URLs and targeted brand intelligence	Plain text, JSON	Free community feed	Analyzing credential-harvesting campaigns and social engineering delivery patterns.
PhishTank	Community-verified phishing website URLs	CSV, XML, JSON	Free REST API with developer key	Validating phishing infrastructure and tracking fraudulent institutional impersonations.
AlienVault OTX	Community threat pulses with mixed IoC telemetry	JSON, STIX/TAXII	Free REST API (registration required)	Investigating broader advanced persistent threat (APT) campaign context and threat actor tactics.

FAQ

What is URLhaus?

URLhaus is an open, community-driven cyber threat intelligence platform operated by abuse.ch in collaboration with Spamhaus. It tracks, verifies, and shares URLs actively used to distribute malware payloads.

How do I obtain an API key for URLhaus?

You can obtain a free API key by creating an account on the abuse.ch Authentication Portal at https://auth.abuse.ch/. Once registered, copy your Auth-Key and supply it in the Auth-Key header of your HTTP requests.

Can I submit phishing websites to URLhaus?

No. URLhaus is dedicated strictly to malware distribution sites. Phishing websites and credential-harvesting pages are out of scope and should be reported to platforms such as PhishTank, APWG, or Netcraft.

What data feed formats does URLhaus support?

URLhaus provides bulk database dumps in CSV and JSON formats, as well as specialized formats including DNS Response Policy Zones (RPZ), Snort and Suricata IDS rulesets, plain-text URL lists, and ClamAV signatures.

How often are URLhaus database dumps refreshed?

URLhaus generates updated database dumps every 5 minutes. Automated collection pipelines and ingestion daemons must not poll or download dumps more frequently than every 5 minutes.

How does URLhaus handle geofenced malware links?

When an adversary restricts malware downloads to specific countries using GeoIP filters, submitters can apply the geofenced tag alongside the three-letter NATO country code (e.g. GBR, DEU, USA). URLhaus will route payload verification through a regional exit node.

Sources

abuse.ch. “URLhaus Community API Documentation.” URLhaus, read 2026-11-09. https://urlhaus.abuse.ch/api/
abuse.ch. “URLhaus Bulk API Documentation.” URLhaus API, read 2026-11-09. https://urlhaus-api.abuse.ch/
abuse.ch. “About URLhaus.” abuse.ch & Spamhaus, read 2026-11-09. https://urlhaus.abuse.ch/about/
abuse.ch. “URLhaus Frequently Asked Questions.” URLhaus, read 2026-11-09. https://urlhaus.abuse.ch/faq/
abuse.ch. “abuse.ch Authentication Portal.” abuse.ch, read 2026-11-09. https://auth.abuse.ch/