M
API Matrix

URLhaus API

⭐ Beginner's Pick Anti-malware / No Auth Required Beginner HTTPS CORS
Free to Use Varies (check documentation)
87 Score
Grade A
Visit Official Site Compare Alternatives

Overview

URLhaus by abuse.ch is a free, no-auth API for querying a database of URLs that are actively distributing malware. You can look up individual URLs, domains, or file hashes to see if they are associated with malware campaigns. Because it requires no authentication, it is one of the easiest security APIs to start experimenting with.

💡

Beginner Tip

No API key needed — just POST to https://urlhaus-api.abuse.ch/v1/url/ with a JSON body containing the url field. You can test it immediately from the terminal without any signup.

Available Data

URLhaus data via REST API
JSON-formatted response data
Freely accessible without authentication

Example Response

JSON Response 
{
  "url": "https://example.com",
  "safe": true,
  "threat_level": "none",
  "categories": [
    "clean"
  ],
  "scan_date": "2025-01-15T10:00:00Z"
}

Field Reference

query_status Result of the lookup: is_online, is_offline, unknown, or no_results
url The URL that was queried
url_status Whether the malicious URL is currently online or offline
threat Type of threat, such as malware_download or botnet_cc
tags Researcher-applied tags describing the malware family or campaign
date_added Timestamp when the URL was first reported to URLhaus

Implementation Example 

const url = "https://urlhaus-api.abuse.ch/";
const response = await fetch(url);
if (!response.ok) throw new Error(`Request failed: ${response.status}`);
const data = await response.json();
console.log(data);

What Can You Build?

Note: These code examples are AI-generated and unverified. Always refer to the official API documentation for accurate usage.

Common Errors & Troubleshooting

"query_status": "no_results" The URL, domain, or hash you queried is not in the URLhaus database
✓ This is a normal response for clean URLs; only malicious and recently observed URLs are tracked in this database
405 Method Not Allowed Sending a GET request instead of POST to the lookup endpoints
✓ URLhaus requires POST requests with a JSON body — use -X POST and -H "Content-Type: application/json" in curl
Empty or slow response The API can be rate-limited during high traffic periods
✓ Add a short retry delay (1-2 seconds) between bulk lookups; the service is free and shared by many researchers

Matrix Score Breakdown

🌐 Reachability 30/30
⚡ Speed 15/20
🔒 Security 15/15
🛠 Developer XP 20/20
✓ Reliability 7/15
Response Time 281ms

Fully tested on Apr 5, 2026

Technical Specifications

Auth No Auth
HTTPS REQUIRED
CORS YES
Category Anti-malware
Difficulty Beginner
Verified: 2026-04-04

Similar APIs

View All →

AbuseIPDB

77

AbuseIPDB lets you check whether an IP address has been reported for malicious activity like spam, hacking, or DDoS attacks.

API Key Intermediate HTTPS

AlienVault Open Threat Exchange (OTX)

0

AlienVault Open Threat Exchange (OTX) provides programmatic access to ip/domain/url reputation via REST API.

API Key Intermediate HTTPS

CAPEsandbox

77

CAPEsandbox is an open-source malware analysis platform that executes suspicious files in an isolated environment and reports on their behavior.

API Key Intermediate HTTPS

Google Safe Browsing

77

Google Safe Browsing lets you check any URL against Google's constantly updated lists of phishing sites, malware distributors, and unwanted software.

API Key Intermediate HTTPS

MalDatabase

0

MalDatabase provides programmatic access to provide malware datasets and threat intelligence feeds via REST API.

API Key Intermediate HTTPS