What is URLhaus?
URLhaus is operated by abuse.ch, a Swiss non-profit security project, and tracks URLs actively being used for malware distribution. Their database is one of the most important and widely used malware URL feeds in the cybersecurity industry. URLhaus data is freely available and integrated into antivirus products, enterprise email security, DNS filtering, and SIEM systems globally. abuse.ch also operates related projects including MalwareBazaar and Feodo Tracker.
Why URLhaus flags legitimate domains
- Your URL was submitted to URLhaus as actively distributing malware payloads
- An automated URLhaus crawler confirmed malware delivery from your URL
- A researcher or automated system identified your URL in a malware distribution campaign
- Your domain was compromised and used to host malware download files without your knowledge
- A subdomain or URL path on your server was linked to a known malware distribution network
What a listing means for your business
URLhaus is a foundational data source for many security products. Their free API is integrated into an enormous range of security tools, from enterprise SIEM systems to open-source IDS configurations. A URLhaus listing can propagate simultaneously across hundreds of downstream products, making it one of the most impactful listings in terms of breadth of coverage.
How BrandsDefender gets you delisted
We verify that your domain is clean, prepare the evidence URLhaus needs, file the false positive dispute through the right channel and follow up until the flag is removed. No cure, no pay.
Frequently asked questions
Does abuse.ch / URLhaus have other related threat intelligence projects?
Yes, abuse.ch operates URLhaus (malware URLs), MalwareBazaar (malware samples), Feodo Tracker (banking trojan C2), and SSLBL (malicious SSL certificates). A flag in any one of these can influence your reputation across the abuse.ch ecosystem.
How do I get a URL removed from URLhaus?
URLhaus marks URLs as 'offline' when they no longer serve malware, but the URL record remains. A formal false positive report is required to dispute incorrect listings. Our team manages the submission through abuse.ch's correct process.