{"uid":"cap_tmXZs4RXA6MmhyiMHXeDF","slug":"sitecheck-web-intel-urlhaus-malware-host-lookup-69908470","name":"SiteCheck Web Intel – URLhaus Malware Host Lookup","description":"Checks whether a host (domain or IP) is known to abuse.ch URLhaus as a malware distribution host: first seen, number of malware URLs, Spamhaus DBL / SURBL status and the latest URLs with status (online/offline), threat type, tags, reporter and URLhaus reference.","url":"https://api.webintel-api.workers.dev/api/security/urlhaus-malware?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["host"],"properties":{"host":{"type":"string","description":"Domain or IPv4 address, e.g. 221.15.252.30 (required)"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_IPPjWv0rCjDhIU1jvCx7a","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks whether a domain or IP address is listed on abuse.ch URLhaus as a malware distribution host, returning threat metadata, Spamhaus/SURBL status, and recent malicious URLs.","exampleAgentPrompt":"Can you check if the domain 221.15.252.30 is listed on URLhaus as a malware host — I want to know its threat type, how many malicious URLs it's been linked to, and whether it's on Spamhaus or SURBL blocklists?","exampleUseCases":[{"title":"Vetting a suspicious inbound email domain","prompt":"I got an email from downloads.fastupdates.net and I'm not sure if it's legit — can you check if that domain is flagged on URLhaus for distributing malware?"},{"title":"Threat intel enrichment for SOC alert","prompt":"We got an alert for outbound traffic to 185.220.101.45 — pull up its URLhaus record so I can see whether it's a known malware host, when it was first flagged, and what threats are associated with it."},{"title":"Brand protection scan for a client domain","prompt":"Before we whitelist cdn.clientupdate.biz in our firewall, check if abuse.ch URLhaus has it listed as a malware distribution host and whether it's on Spamhaus DBL or SURBL."}],"resultDescription":"Returns URLhaus host record including: first-seen timestamp, total count of malware URLs hosted, Spamhaus DBL and SURBL blocklist status, and a list of recent associated URLs each with online/offline status, threat type (e.g. malware_download, botnet_cc), associated tags, reporter handle, and URLhaus reference link.","failureModes":["Host not found in URLhaus database — clean or unknown host returns no record","Invalid host format (e.g. IPv6, hostname typo) may return an error or empty result","Rate limiting or upstream URLhaus API unavailability may cause timeouts","Stale data — URLhaus records may lag real-time host activity by hours or days"],"whenToPreferThis":"Use this endpoint when you need to check a specific domain or IP against the abuse.ch URLhaus malware distribution database, especially when you also want Spamhaus DBL and SURBL status in one call. Prefer this over generic threat intel APIs when URLhaus coverage is specifically required — it is the canonical source for malware URL distribution data.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-24T12:36:48.475Z","isFirstParty":false,"canonicalSlug":"sitecheck-web-intel-urlhaus-malware-host-lookup-69908470"}