Docs
Open Lodol
DocumentationIntegrationsAPI

URLhaus

App · Compliance & Security · 8 actions

Check links, domains and files against URLhaus, abuse.ch's database of websites that spread malware: find out whether a URL is known malware and still online, what a domain or IP address has served, which files a URL dropped and which URLs served a file. Look up tags and malware families, and pull the newest malware URLs and payloads for a blocklist. Needs a free abuse.ch Auth-Key.

Actions

ActionWhat it does
List recent malware URLsGet the malware URLs most recently added to URLhaus, newest first: up to 1,000 from the last 3 days, each with whether it is still online, its host, tags and blocklist status.
List recent payloadsGet the payloads (malware files) URLhaus most recently collected from malware URLs, newest first: up to 1,000 from the last 3 days, each with its MD5 and SHA-256 hashes, file type, malware family when known and VirusTotal detections.
Look up file hashLook up a file by its MD5 or SHA-256 hash: its file type and malware family, when it was first and last seen, VirusTotal detections, and up to 100 malware URLs that served it.
Look up hostCheck a domain, host name or IP address: how many malware URLs it has served and since when, its Spamhaus and SURBL blocklist status, and up to 100 of its malware URLs with whether each is still online.
Look up malware familyGet the malware URLs whose files URLhaus identified as a malware family (its signature), like Heodo or Gozi, newest first, with each file's hashes and how many URLs and files the family has.
Look up tagGet the malware URLs reporters gave a tag, like elf or a malware name, newest first, with how many URLs carry it and when it was first and last used.
Look up URLCheck whether a URL is a known malware URL: whether it is still online, when it was added, its tags, its Spamhaus and SURBL blocklist status, and the files (payloads) it served.
Look up URL by IDGet a malware URL by its URLhaus ID, with the same details as Look up URL: whether it is still online, its tags, blocklist status and the files it served.

List recent malware URLs

Get the malware URLs most recently added to URLhaus, newest first: up to 1,000 from the last 3 days, each with whether it is still online, its host, tags and blocklist status. Use it to keep a blocklist or firewall up to date.

Inputs

Maximum URLslimitnumber
Optional. How many URLs to get, newest first: up to 1,000 from the last 3 days. 100 when left empty.From 1 to 1000. Default: 100.

Outputs

countnumber
How many came back
urlslist
The URLs, newest first
Example output
{
  "count": 2,
  "urls": [
    {
      "blacklists": {
        "spamhaus_dbl": "not listed",
        "surbl": "not listed"
      },
      "date_added": "2019-08-10T09:02:05+00:00",
      "host": "45.61.49.78",
      "hosting_provider_notified": true,
      "reporter": "zbetcheckin",
      "tags": [
        "elf"
      ],
      "threat": "malware_download",
      "url": "http://45.61.49.78/razor/r4z0r.mips",
      "url_id": 223622,
      "url_status": "offline",
      "urlhaus_link": "https://urlhaus.abuse.ch/url/223622/"
    },
    {
      "blacklists": {
        "spamhaus_dbl": "not listed",
        "surbl": "not listed"
      },
      "date_added": "2019-08-10T09:02:03+00:00",
      "host": "45.61.49.78",
      "hosting_provider_notified": true,
      "reporter": "zbetcheckin",
      "tags": [
        "elf",
        "mirai"
      ],
      "threat": "malware_download",
      "url": "http://45.61.49.78/razor/r4z0r.sh4",
      "url_id": 223621,
      "url_status": "offline",
      "urlhaus_link": "https://urlhaus.abuse.ch/url/223621/"
    }
  ]
}

List recent payloads

Get the payloads (malware files) URLhaus most recently collected from malware URLs, newest first: up to 1,000 from the last 3 days, each with its MD5 and SHA-256 hashes, file type, malware family when known and VirusTotal detections.

Inputs

Maximum payloadslimitnumber
Optional. How many payloads to get, newest first: up to 1,000 from the last 3 days. 100 when left empty.From 1 to 1000. Default: 100.

Outputs

countnumber
How many came back
payloadslist
The payloads, newest first
Example output
{
  "count": 2,
  "payloads": [
    {
      "download_url": "https://urlhaus-api.abuse.ch/v1/download/0c415dd718e3b3728707d579cf8214f54c2942e964975a5f925e0b82fea644b4/",
      "file_size": 656896,
      "file_type": "exe",
      "first_seen": "2019-08-10T11:09:23+00:00",
      "imphash": "3b91ed9563d0f99f26b86bd20539306b",
      "magika": "pebin",
      "malware_family": null,
      "md5_hash": "99ad3000abb169e60844a0689dbe9f8c",
      "sha256_hash": "0c415dd718e3b3728707d579cf8214f54c2942e964975a5f925e0b82fea644b4",
      "ssdeep": "3072:HwVYswg6L/wnhOTKuX/2hz9SbwtbS6UOhRP0Ml/5hIowZtQnKZUJkegNS+Gjs:cWInU/8PbRXl/TIoc2h+Gj",
      "tlsh": "7934BF47B4F1C871E4B30D311831D9A05A2F7D715F659E6B2778222A8E342D09E35FAB",
      "virustotal": {
        "detections": null,
        "engines": null,
        "link": null,
        "percent": null
      }
    },
    {
      "download_url": "https://urlhaus-api.abuse.ch/v1/download/b181e6e08cfdebbd9cfcb0e3ccd3976ed51c7edefc69ec826e73d3324d646b2e/",
      "file_size": 416456,
      "file_type": "exe",
      "first_seen": "2019-08-10T11:08:49+00:00",
      "imphash": "3b91ed9563d0f99f26b86bd20539306b",
      "magika": "pebin",
      "malware_family": null,
      "md5_hash": "379e008c8e6aa462cbc9f93c7519d36a",
      "sha256_hash": "b181e6e08cfdebbd9cfcb0e3ccd3976ed51c7edefc69ec826e73d3324d646b2e",
      "ssdeep": "3072:HwVYswg6L/wnhOTKuX/2hz9SbwtbS6UOhRP0Ml/5hIowZtQnKZUJkegNS+Gjs:cWInU/8PbRXl/TIoc2h+Gj",
      "tlsh": "7934BF47B4F1C871E4B30D311831D9A05A2F7D715F659E6B2778222A8E342D09E35FAB",
      "virustotal": {
        "detections": null,
        "engines": null,
        "link": null,
        "percent": null
      }
    }
  ]
}

Look up file hash

Look up a file by its MD5 or SHA-256 hash: its file type and malware family, when it was first and last seen, VirusTotal detections, and up to 100 malware URLs that served it. A file URLhaus doesn't have comes back with found false.

Inputs

File hashfile_hashtextRequired
The file's MD5 or SHA-256 hash. A link that holds one, like the download link URLhaus returns or a VirusTotal file report, is read too.

Outputs

download_urltext
URLhaus's download link for a copy of the file, a ZIP archive holding live malware. It needs the Auth-Key header
file_sizenumber
The file's size in bytes
file_typetext
The file type URLhaus made out, like exe, doc, elf or zip
first_seentext
When URLhaus first saw the file (ISO 8601, UTC)
foundtrue/false
True when URLhaus has it. False when it doesn't, which is the answer for anything never reported as spreading malware
imphashtext
The file's import hash (Windows programs only)
last_seentext
When URLhaus last saw the file (ISO 8601, UTC). Empty when it saw it only once
magikatext
The file type Google's Magika made out, like pebin or doc
malware_familytext
The malware family URLhaus identified in the file, like Heodo or Mozi. Empty when it identified none
md5_hashtext
The file's MD5 hash
sha256_hashtext
The file's SHA-256 hash
ssdeeptext
The file's ssdeep fuzzy hash
tlshtext
The file's TLSH fuzzy hash
url_countnumber
How many malware URLs served it, in all
urlslist
The malware URLs that served it, up to 100
virustotalobject
VirusTotal's verdict on the file. Empty when VirusTotal has none
Example output
{
  "download_url": "https://urlhaus-api.abuse.ch/v1/download/35e304d10d53834e3e41035d12122773c9a4d183a24e03f980ad3e6b2ecde7fa/",
  "file_size": 241664,
  "file_type": "exe",
  "first_seen": "2019-01-19T13:59:06+00:00",
  "found": true,
  "imphash": "3b91ed9563d0f99f26b86bd20539306b",
  "last_seen": "2019-01-19T14:48:08+00:00",
  "magika": "pebin",
  "malware_family": "Heodo",
  "md5_hash": "1585ad28f7d1e0ca696e6c6c2f1d008a",
  "sha256_hash": "35e304d10d53834e3e41035d12122773c9a4d183a24e03f980ad3e6b2ecde7fa",
  "ssdeep": "3072:HwVYswg6L/wnhOTKuX/2hz9SbwtbS6UOhRP0Ml/5hIowZtQnKZUJkegNS+Gjs:cWInU/8PbRXl/TIoc2h+Gj",
  "tlsh": "7934BF47B4F1C871E4B30D311831D9A05A2F7D715F659E6B2778222A8E342D09E35FAB",
  "url_count": null,
  "urls": [
    {
      "filename": "PAY2632216543098764.doc",
      "first_seen": "2019-01-19",
      "last_seen": null,
      "url": "http://www.mother-earth.net/bn/wp-content/KwmW-WSOO_jYDW-B2t/PaymentStatus/EN_en/277-20-468894-239-277-20-468894-861/",
      "url_id": 105243,
      "url_status": "offline",
      "urlhaus_link": "https://urlhaus.abuse.ch/url/105243/"
    },
    {
      "filename": "5518475554292.doc",
      "first_seen": "2019-01-19",
      "last_seen": null,
      "url": "http://demo.trydaps.com/gzVv-22Omv_aIQZybVK-aJ/En/Question/",
      "url_id": 105214,
      "url_status": "offline",
      "urlhaus_link": "https://urlhaus.abuse.ch/url/105214/"
    }
  ],
  "virustotal": {
    "detections": 17,
    "engines": 69,
    "link": "https://www.virustotal.com/file/35e304d10d53834e3e41035d12122773c9a4d183a24e03f980ad3e6b2ecde7fa/analysis/1547905746/",
    "percent": 24.64
  }
}

Look up host

Check a domain, host name or IP address: how many malware URLs it has served and since when, its Spamhaus and SURBL blocklist status, and up to 100 of its malware URLs with whether each is still online. A host URLhaus doesn't have comes back with found false.

Inputs

HosthosttextRequired
A domain, host name or IPv4 address, like example.com or 203.0.113.7. A URL is read as its host.

Outputs

blacklistsobject
Whether the domain is on the Spamhaus DBL and SURBL blocklists. Empty when URLhaus doesn't say, as for an IP address in Look up host
first_seentext
When URLhaus first saw a malware URL on it (ISO 8601, UTC)
foundtrue/false
True when URLhaus has it. False when it doesn't, which is the answer for anything never reported as spreading malware
hosttext
The host looked up
url_countnumber
How many malware URLs URLhaus has seen on it, in all
urlhaus_linktext
Its page on URLhaus
urlslist
Its malware URLs, up to 100
Example output
{
  "blacklists": {
    "spamhaus_dbl": "abused_legit_malware",
    "surbl": "not listed"
  },
  "first_seen": "2019-01-15T07:09:01+00:00",
  "found": true,
  "host": "vektorex.com",
  "url_count": 120,
  "urlhaus_link": "https://urlhaus.abuse.ch/host/vektorex.com/",
  "urls": [
    {
      "date_added": "2019-02-11T07:45:05+00:00",
      "hosting_provider_notified": false,
      "reporter": "abuse_ch",
      "tags": [
        "AZORult",
        "exe"
      ],
      "takedown_time_seconds": null,
      "threat": "malware_download",
      "url": "http://vektorex.com/source/Z/5016223.exe",
      "url_id": 121319,
      "url_status": "online",
      "urlhaus_link": "https://urlhaus.abuse.ch/url/121319/"
    },
    {
      "date_added": "2019-02-11T06:47:03+00:00",
      "hosting_provider_notified": false,
      "reporter": "abuse_ch",
      "tags": [
        "exe",
        "Loki"
      ],
      "takedown_time_seconds": null,
      "threat": "malware_download",
      "url": "http://vektorex.com/source/Z/Order%20839.png",
      "url_id": 121316,
      "url_status": "online",
      "urlhaus_link": "https://urlhaus.abuse.ch/url/121316/"
    }
  ]
}

Look up malware family

Get the malware URLs whose files URLhaus identified as a malware family (its signature), like Heodo or Gozi, newest first, with each file's hashes and how many URLs and files the family has. Unlike a tag, the family is URLhaus's own finding.

Inputs

Malware familymalware_familytextRequired
The malware family, as URLhaus names it, like Gozi or Heodo. Capitals don't matter. A family with very many URLs, like Mozi, can take URLhaus minutes to list, or longer than it allows.
Maximum URLslimitnumber
Optional. How many of its URLs to return, newest first, up to the 1,000 URLhaus sends. 100 when left empty.From 1 to 1000. Default: 100.

Outputs

countnumber
How many URLs came back
first_seentext
When URLhaus first saw the family (ISO 8601, UTC)
foundtrue/false
True when URLhaus has it. False when it doesn't, which is the answer for anything never reported as spreading malware
last_seentext
When URLhaus last saw the family (ISO 8601, UTC)
malware_familytext
The malware family looked up
payload_countnumber
How many of its files URLhaus has, in all
url_countnumber
How many URLs served the family, in all
urlslist
URLs that served the family, newest first, with the file each served
Example output
{
  "count": 2,
  "first_seen": "2018-03-27T13:48:55+00:00",
  "found": true,
  "last_seen": "2019-01-24T13:08:08+00:00",
  "malware_family": "Gozi",
  "payload_count": 12787,
  "url_count": 2125,
  "urls": [
    {
      "download_url": "https://urlhaus-api.abuse.ch/v1/download/254ca6a7a7ef7f17d9884c4a86f88b5d5fd8fe5341c0996eaaf1d4bcb3b2337b/",
      "file_size": 125952,
      "file_type": "exe",
      "filename": null,
      "first_seen": "2019-01-02T12:42:23+00:00",
      "imphash": "3b91ed9563d0f99f26b86bd20539306b",
      "last_seen": "2019-01-02T13:13:25+00:00",
      "magika": "pebin",
      "md5_hash": "a820381c8acf07cfcb4d9b13498db71d",
      "sha256_hash": "254ca6a7a7ef7f17d9884c4a86f88b5d5fd8fe5341c0996eaaf1d4bcb3b2337b",
      "ssdeep": "3072:HwVYswg6L/wnhOTKuX/2hz9SbwtbS6UOhRP0Ml/5hIowZtQnKZUJkegNS+Gjs:cWInU/8PbRXl/TIoc2h+Gj",
      "tlsh": "7934BF47B4F1C871E4B30D311831D9A05A2F7D715F659E6B2778222A8E342D09E35FAB",
      "url": "http://185.189.149.164/adobe_update.exe",
      "url_id": 100211,
      "url_status": "offline",
      "urlhaus_link": "https://urlhaus.abuse.ch/url/100211/",
      "virustotal": {
        "detections": null,
        "engines": null,
        "link": null,
        "percent": null
      }
    },
    {
      "download_url": "https://urlhaus-api.abuse.ch/v1/download/462f6a7560ef2a1a815febebf60b1fcb472a8227d6db05ac09e5266b774c3722/",
      "file_size": 137216,
      "file_type": "exe",
      "filename": null,
      "first_seen": "2019-01-02T12:11:02+00:00",
      "imphash": "3b91ed9563d0f99f26b86bd20539306b",
      "last_seen": "2019-01-10T16:49:17+00:00",
      "magika": "pebin",
      "md5_hash": "24ba99e7fffa82660f61fcdfc941caa4",
      "sha256_hash": "462f6a7560ef2a1a815febebf60b1fcb472a8227d6db05ac09e5266b774c3722",
      "ssdeep": "3072:HwVYswg6L/wnhOTKuX/2hz9SbwtbS6UOhRP0Ml/5hIowZtQnKZUJkegNS+Gjs:cWInU/8PbRXl/TIoc2h+Gj",
      "tlsh": "7934BF47B4F1C871E4B30D311831D9A05A2F7D715F659E6B2778222A8E342D09E35FAB",
      "url": "http://66.55.64.137/e07f11vm2ghf.exe",
      "url_id": 101092,
      "url_status": "online",
      "urlhaus_link": "https://urlhaus.abuse.ch/url/101092/",
      "virustotal": {
        "detections": 47,
        "engines": 72,
        "link": "https://www.virustotal.com/file/462f6a7560ef2a1a815febebf60b1fcb472a8227d6db05ac09e5266b774c3722/analysis/1546191578/",
        "percent": 65.28
      }
    }
  ]
}

Look up tag

Get the malware URLs reporters gave a tag, like elf or a malware name, newest first, with how many URLs carry it and when it was first and last used.

Inputs

TagtagtextRequired
A tag reporters put on malware URLs, like a malware name such as Retefe. Capitals don't matter. A tag on very many URLs, like elf or Mozi, can take URLhaus minutes to list, or longer than it allows.
Maximum URLslimitnumber
Optional. How many of its URLs to return, newest first, up to the 1,000 URLhaus sends. 100 when left empty.From 1 to 1000. Default: 100.

Outputs

countnumber
How many URLs came back
first_seentext
When the tag was first used (ISO 8601, UTC)
foundtrue/false
True when URLhaus has it. False when it doesn't, which is the answer for anything never reported as spreading malware
last_seentext
When the tag was last used (ISO 8601, UTC)
tagtext
The tag looked up
url_countnumber
How many URLs carry the tag, in all
urlslist
URLs that carry the tag, newest first
Example output
{
  "count": 2,
  "first_seen": "2018-03-06T15:27:00+00:00",
  "found": true,
  "last_seen": "2018-12-21T06:00:11+00:00",
  "tag": "Retefe",
  "url_count": 265,
  "urls": [
    {
      "date_added": "2018-12-21T06:00:11+00:00",
      "reporter": "abuse_ch",
      "threat": "malware_download",
      "url": "https://tagmanager.vn//wp-content/themes/pridmag/sup.exe",
      "url_id": 98627,
      "url_status": "offline",
      "urlhaus_link": "https://urlhaus.abuse.ch/url/98627/"
    },
    {
      "date_added": "2018-12-20T15:47:14+00:00",
      "reporter": "switchcert",
      "threat": "malware_download",
      "url": "http://tagmanager.vn/wp-content/themes/pridmag/sup.exe",
      "url_id": 98349,
      "url_status": "offline",
      "urlhaus_link": "https://urlhaus.abuse.ch/url/98349/"
    }
  ]
}

Look up URL

Check whether a URL is a known malware URL: whether it is still online, when it was added, its tags, its Spamhaus and SURBL blocklist status, and the files (payloads) it served. A URL URLhaus doesn't have comes back with found false, not an error.

Inputs

URLurltextRequired
The whole URL, as it was found, like http://example.com/invoice.exe. URLhaus matches it exactly, so keep http or https and any slash at the end. A defanged URL, like hxxp://example[.]com/x, is read too.

Outputs

blacklistsobject
Whether the domain is on the Spamhaus DBL and SURBL blocklists. Empty when URLhaus doesn't say, as for an IP address in Look up host
date_addedtext
When the URL was added to URLhaus (ISO 8601, UTC)
foundtrue/false
True when URLhaus has it. False when it doesn't, which is the answer for anything never reported as spreading malware
hosttext
The URL's host: a domain or IP address
hosting_provider_notifiedtrue/false
True when URLhaus has told the hosting provider about it, so it can be taken down
last_onlinetext
When an offline URL last served malware (ISO 8601, UTC). Empty while it is online
payloadslist
The files (payloads) the URL served, up to 100, with their hashes and malware family
reportertext
Who reported it to URLhaus, or anonymous
tagslist
The tags reporters gave it, like elf, exe or a malware name
takedown_time_secondsnumber
How long the hosting provider took to take the URL down, in seconds. Empty while it is up, or when URLhaus doesn't know
threattext
What the URL does: malware_download, a site that spreads malware
urltext
The URL looked up, as URLhaus has it
url_idnumber
URLhaus's ID for the URL, which Look up URL by ID takes
url_statustext
online (serving malware now), offline (not anymore) or unknown (URLhaus could not tell)
urlhaus_linktext
Its page on URLhaus
Example output
{
  "blacklists": {
    "spamhaus_dbl": "abused_legit_malware",
    "surbl": "listed"
  },
  "date_added": "2019-01-19T01:33:26+00:00",
  "found": true,
  "host": "sskymedia.com",
  "hosting_provider_notified": true,
  "last_online": null,
  "payloads": [
    {
      "download_url": "https://urlhaus-api.abuse.ch/v1/download/dc9f3b226bccb2f1fd4810cde541e5a10d59a1fe683f4a9462293b6ade8d8403/",
      "file_size": 179664,
      "file_type": "doc",
      "filename": "5616769081079106.doc",
      "first_seen": "2019-01-19",
      "imphash": "4e4a95a7659118e966a42f4a73311fda",
      "magika": "doc",
      "malware_family": null,
      "md5_hash": "fedfa8ad9ee7846b88c5da79b32f6551",
      "sha256_hash": "dc9f3b226bccb2f1fd4810cde541e5a10d59a1fe683f4a9462293b6ade8d8403",
      "ssdeep": "3072:+hcypCDJeA/9LH1sQx+YiSP2eiLe8/Gq2CeFUzJCfaDehYbAg9u/AJOOxxSEeXq1:LFZj1f+YiSP2Re8J2AehiQxOHSERtIgN",
      "tlsh": "1D340235A5E22807ED4F8479F75F8068BD4A8C96DE9DF244993C6A1A2077020C6F7F93",
      "virustotal": {
        "detections": 16,
        "engines": 58,
        "link": "https://www.virustotal.com/file/dc9f3b226bccb2f1fd4810cde541e5a10d59a1fe683f4a9462293b6ade8d8403/analysis/1547871259/",
        "percent": 27.59
      }
    },
    {
      "download_url": "https://urlhaus-api.abuse.ch/v1/download/01fa56184fcaa42b6ee1882787a34098c79898c182814774fd81dc18a6af0b00/",
      "file_size": 174928,
      "file_type": "doc",
      "filename": "ATT932454259403171471.doc",
      "first_seen": "2019-01-19",
      "imphash": "4e4a95a7659118e966a42f4a73311fda",
      "magika": "doc",
      "malware_family": "Heodo",
      "md5_hash": "12c8aec5766ac3e6f26f2505e2f4a8f2",
      "sha256_hash": "01fa56184fcaa42b6ee1882787a34098c79898c182814774fd81dc18a6af0b00",
      "ssdeep": "3072:+hcypCDJeA/9LH1sQx+YiSP2eiLe8/Gq2CeFUzJCfaDehYbAg9u/AJOOxxSEeXq1:LFZj1f+YiSP2Re8J2AehiQxOHSERtIgN",
      "tlsh": "1D340235A5E22807ED4F8479F75F8068BD4A8C96DE9DF244993C6A1A2077020C6F7F93",
      "virustotal": {
        "detections": null,
        "engines": null,
        "link": null,
        "percent": null
      }
    }
  ],
  "reporter": "Cryptolaemus1",
  "tags": [
    "emotet",
    "epoch2",
    "heodo"
  ],
  "takedown_time_seconds": null,
  "threat": "malware_download",
  "url": "http://sskymedia.com/VMYB-ht_JAQo-gi/INV/99401FORPO/20673114777/US/Outstanding-Invoices/",
  "url_id": 105821,
  "url_status": "online",
  "urlhaus_link": "https://urlhaus.abuse.ch/url/105821/"
}

Look up URL by ID

Get a malware URL by its URLhaus ID, with the same details as Look up URL: whether it is still online, its tags, blocklist status and the files it served. An ID URLhaus doesn't have comes back with found false.

Inputs

URL IDurl_idtextRequired
The number URLhaus gives a URL, like 105821, or the link to its page on URLhaus, like https://urlhaus.abuse.ch/url/105821/. The other URLhaus actions return both.

Outputs

blacklistsobject
Whether the domain is on the Spamhaus DBL and SURBL blocklists. Empty when URLhaus doesn't say, as for an IP address in Look up host
date_addedtext
When the URL was added to URLhaus (ISO 8601, UTC)
foundtrue/false
True when URLhaus has it. False when it doesn't, which is the answer for anything never reported as spreading malware
hosttext
The URL's host: a domain or IP address
hosting_provider_notifiedtrue/false
True when URLhaus has told the hosting provider about it, so it can be taken down
last_onlinetext
When an offline URL last served malware (ISO 8601, UTC). Empty while it is online
payloadslist
The files (payloads) the URL served, up to 100, with their hashes and malware family
reportertext
Who reported it to URLhaus, or anonymous
tagslist
The tags reporters gave it, like elf, exe or a malware name
takedown_time_secondsnumber
How long the hosting provider took to take the URL down, in seconds. Empty while it is up, or when URLhaus doesn't know
threattext
What the URL does: malware_download, a site that spreads malware
urltext
The URL looked up, as URLhaus has it
url_idnumber
URLhaus's ID for the URL, which Look up URL by ID takes
url_statustext
online (serving malware now), offline (not anymore) or unknown (URLhaus could not tell)
urlhaus_linktext
Its page on URLhaus
Example output
{
  "blacklists": {
    "spamhaus_dbl": "abused_legit_malware",
    "surbl": "listed"
  },
  "date_added": "2019-01-19T01:33:26+00:00",
  "found": true,
  "host": "sskymedia.com",
  "hosting_provider_notified": true,
  "last_online": null,
  "payloads": [
    {
      "download_url": "https://urlhaus-api.abuse.ch/v1/download/dc9f3b226bccb2f1fd4810cde541e5a10d59a1fe683f4a9462293b6ade8d8403/",
      "file_size": 179664,
      "file_type": "doc",
      "filename": "5616769081079106.doc",
      "first_seen": "2019-01-19",
      "imphash": "4e4a95a7659118e966a42f4a73311fda",
      "magika": "doc",
      "malware_family": null,
      "md5_hash": "fedfa8ad9ee7846b88c5da79b32f6551",
      "sha256_hash": "dc9f3b226bccb2f1fd4810cde541e5a10d59a1fe683f4a9462293b6ade8d8403",
      "ssdeep": "3072:+hcypCDJeA/9LH1sQx+YiSP2eiLe8/Gq2CeFUzJCfaDehYbAg9u/AJOOxxSEeXq1:LFZj1f+YiSP2Re8J2AehiQxOHSERtIgN",
      "tlsh": "1D340235A5E22807ED4F8479F75F8068BD4A8C96DE9DF244993C6A1A2077020C6F7F93",
      "virustotal": {
        "detections": 16,
        "engines": 58,
        "link": "https://www.virustotal.com/file/dc9f3b226bccb2f1fd4810cde541e5a10d59a1fe683f4a9462293b6ade8d8403/analysis/1547871259/",
        "percent": 27.59
      }
    },
    {
      "download_url": "https://urlhaus-api.abuse.ch/v1/download/01fa56184fcaa42b6ee1882787a34098c79898c182814774fd81dc18a6af0b00/",
      "file_size": 174928,
      "file_type": "doc",
      "filename": "ATT932454259403171471.doc",
      "first_seen": "2019-01-19",
      "imphash": "4e4a95a7659118e966a42f4a73311fda",
      "magika": "doc",
      "malware_family": "Heodo",
      "md5_hash": "12c8aec5766ac3e6f26f2505e2f4a8f2",
      "sha256_hash": "01fa56184fcaa42b6ee1882787a34098c79898c182814774fd81dc18a6af0b00",
      "ssdeep": "3072:+hcypCDJeA/9LH1sQx+YiSP2eiLe8/Gq2CeFUzJCfaDehYbAg9u/AJOOxxSEeXq1:LFZj1f+YiSP2Re8J2AehiQxOHSERtIgN",
      "tlsh": "1D340235A5E22807ED4F8479F75F8068BD4A8C96DE9DF244993C6A1A2077020C6F7F93",
      "virustotal": {
        "detections": null,
        "engines": null,
        "link": null,
        "percent": null
      }
    }
  ],
  "reporter": "Cryptolaemus1",
  "tags": [
    "emotet",
    "epoch2",
    "heodo"
  ],
  "takedown_time_seconds": null,
  "threat": "malware_download",
  "url": "http://sskymedia.com/VMYB-ht_JAQo-gi/INV/99401FORPO/20673114777/US/Outstanding-Invoices/",
  "url_id": 105821,
  "url_status": "online",
  "urlhaus_link": "https://urlhaus.abuse.ch/url/105821/"
}

Urban Dictionary

Previous Page

USAJOBS

Next Page

On this page

ActionsList recent malware URLsList recent payloadsLook up file hashLook up hostLook up malware familyLook up tagLook up URLLook up URL by ID