URLhaus

Overview

URLhaus (by abuse.ch) tracks malicious URLs — malware distribution and phishing — with a REST API for lookups and submissions.

⚠️ Breaking change (verified 2026-08): API requests now return HTTP 401 “Unauthorized” — the API requires an API key (the keyless query tier was removed). Register an account at urlhaus.abuse.ch and use the key from your profile.

Quick Start

Register at urlhaus.abuse.ch for a key, then (replace YOUR_KEY):

curl "https://urlhaus-api.abuse.ch/v1/url/" \
  -H "Auth-Key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "http://example.com/malware.exe"}'

{
  "query_status": "no_results",
  "url": "http://example.com/malware.exe"
}

Host lookup:

curl "https://urlhaus-api.abuse.ch/v1/host/" \
  -H "Auth-Key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"host": "example.com"}'

Authentication

• Register at urlhaus.abuse.ch → your API key is on your profile page.
• Send it as the Auth-Key header (missing/invalid → 401, verified).

Rate Limits & Notes

• The API enforces per-user rate limits (see docs) — keys are free.
• Endpoints: /v1/url/ (URL lookup/submit), /v1/host/, /v1/payload/, /v1/recent/.
• query_status in the response tells you the result (“no_results”, “ok”, “url_recently_online”, …).
• The site’s web search remains free for manual lookups.

FAQ

Is URLhaus free? The API is free but now requires an API key (401 without, verified).

How do I get a key? Register at urlhaus.abuse.ch — the key is on your profile.

What can I query? URLs, hosts, payloads, and recent additions.