URLhaus lists URLs that distribute malware. If a page on your domain is listed, mail filters, firewalls and browsers can block it. Here is how to get it cleaned and removed.
- List zone: URLhaus
- Operated by: abuse.ch (Bern University of Applied Sciences)
- List type: Malware URL database
- Typical removal time: 1 to 5 days
What is Abuse.ch URLhaus?
URLhaus is a project by abuse.ch that collects and shares URLs used to distribute malware. Security researchers submit URLs, and the database feeds many firewalls, DNS filters, email gateways and blocklists. Each entry is tied to a specific URL on your domain, together with its status (online or offline).
Why domains get listed on Abuse.ch URLhaus
- Your website was hacked and is serving malware files or droppers
- An outdated CMS plugin let attackers upload malicious files
- A file-sharing or upload folder on your site is hosting malware from users
- A link on your domain redirects to a malware download
What a listing means for your email
Security products that use URLhaus data can block your website and any email that links to it, even after you think the site is clean.
How to get delisted from Abuse.ch URLhaus
Find the listed URLs
Search your domain on URLhaus and write down every listed URL, the malware family and the date it was reported.
Remove the malware
Delete the malicious files, update your CMS and plugins, change all hosting and admin passwords, and check for backdoors. The listed URLs should return a 404 or a clean page.
Tip: Ask your host for a malware scan. Hacked sites are often reinfected through a hidden backdoor.
Get the URLs marked offline
URLhaus checks listed URLs automatically and marks them offline once they stop serving malware. If you believe the listing is a mistake, contact abuse.ch through the contact details on the URLhaus website with the URL and evidence.
Check downstream blocklists
Firewalls and DNS filters that copied the entry may need a few days to update. Recheck your domain on the main security vendors.
Let BrandsDefender handle it
We find the cause, file the Abuse.ch URLhaus removal request and monitor all 20 spam blacklists so you are warned before your emails bounce. No cure, no pay.
Frequently asked questions
Does URLhaus delete entries completely?
Usually entries stay in the database for history but are marked offline. Most security products only block URLs that are online, so the offline status is what matters.
Why was my site reported if I did nothing wrong?
Most URLhaus listings come from hacked websites. The owner is a victim, but the site still needs to be cleaned before the entry is marked offline.