01 · Product name
URLhaus
abuse.ch and Spamhaus malware-URL sharing.
Published by abuse.ch and Spamhaus.
In short
URLhaus is the malware-URL platform abuse.ch and Spamhaus operate. On 22 Oct 2026 the about page said it collects, tracks, and shares malware URLs, and that submissions go to Spamhaus DBL, SURBL, and Google Safe Browsing. The community API page says the API is free under fair use, and that commercial use may require the paid enhanced API. No dollar price and no SPDX field were printed. Browse and statistics returned Varnish Error 405 Banned. Threat intelligence is the category. A listed URL is a lead, not a method.
Product pricing strategy
02
Free and paid
The URLhaus community API page, opened 22 Oct 2026, says the API is free of charge under the fair use principles. The next sentence says use by companies, networks, or individuals with commercial or for-profit needs may require a paid subscription for the enhanced abuse.ch commercial API. No dollar amount was printed on the about page, the API page, or the homepage. No SPDX field was printed. Free under fair use and a possible paid commercial API are two sentences. Do not turn the second into a price that the page did not print. The 4.5 billion mailbox line and the 11.7 million IOC line are Spamhaus's sentence on the about page. They are not fees. The 15,000 figure is the abuse.ch homepage's community count.
Utility and features
03
https://urlhaus.abuse.ch/about/ says URLhaus is operated by abuse.ch and Spamhaus to collect, track, and share malware URLs. The same page says submissions are shared with security vendors and blocklist providers, and it names Spamhaus DBL, SURBL, and Google Safe Browsing. The Spamhaus paragraph on that page says Spamhaus protects 4.5 billion mailboxes and helps secure networks against 11.7 million indicators of compromise. Those two figures are the Spamhaus sentence. They are not a count of URLhaus rows.
- Operators are abuse.ch and Spamhaus. The about page says URLhaus collects, tracks, and shares malware URLs, and names Spamhaus DBL, SURBL, and Google Safe Browsing.
- Fair use, no dollar. The API page says the community API is free under fair use, and that commercial use may require the paid enhanced API. No dollar was printed.
- Browse was banned. The browse and statistics URLs returned Varnish Error 405 Banned. Those pages were not opened as a database.
The abuse.ch homepage, opened the same day, says the project is supported by a community of 15,000 specialist researchers, and the platforms block says abuse.ch maintains six public platforms. A later passage on that same fetched homepage, in a Community First teaser, says the number of platforms has grown to seven. Six and seven stay on their own sentences. The community API page says an Auth-Key is required, that dumps are generated every 5 minutes, and that a full dump contains URLs that are actively distributing malware or that were added within the past 90 days. This listing does not paste the page's curl example. The browse and statistics pages returned Varnish Error 405 Banned, Error 54113. The homepage is a set of marketing cards, not a result table.
- 1
Quote the Spamhaus 4.5 billion and 11.7 million figures as the about page's Spamhaus sentence, not as a URLhaus row count.
- 2
Keep six platforms and seven platforms on the sentences that printed them.
- 3
Do not describe a URL row from the browse page. This browser received Error 405.
Caveats
04
The database pages this browser requested did not open. https://urlhaus.abuse.ch/browse/ and the statistics URL returned Varnish Error 405 Banned. A banned page is not a result set, and the homepage cards are not a substitute. Do not invent a live URL count from a page that did not load.
Six public platforms is the homepage platforms block. Seven is the Community First teaser on the same fetch. Quote the sentence you mean. The Spamhaus mailbox and IOC figures are not URLhaus totals. An Auth-Key is required for the documented downloads. This listing does not repeat the sample command. A malware URL on a list you are allowed to check is a lead for a defender. It is not a procedure for fetching or running a payload.
Potential use cases
06
- A count of URLhaus rows is about to be filled in from the Spamhaus sentence. On 22 Oct 2026 the about page said Spamhaus protects 4.5 billion mailboxes and helps secure networks against 11.7 million indicators. Those figures are Spamhaus's sentence. The abuse.ch homepage said a community of 15,000. None of those numbers is a URLhaus URL count.
- The platform count is about to be picked. The abuse.ch homepage platforms block says six public platforms. A Community First teaser on the same fetched page says the number has grown to seven. Quote the sentence you mean. The URLhaus about page names abuse.ch and Spamhaus as the operators and names Spamhaus DBL, SURBL, and Google Safe Browsing as sharing targets.
- A malware URL is about to be described from the browse page. That URL returned Varnish Error 405 Banned, and so did the statistics URL. The homepage is marketing cards. Do not invent a live row. The API page says the community API is free under fair use and that commercial use may require the enhanced API. No dollar was printed.
Hard cases
The case where the first result is easy to over-read.
A 405 becomes a URL count
The browse and statistics pages did not open. Error 405 Banned is the response. A memo that quotes a live URLhaus total from this review is quoting a page that was not a database. Cite the about page and the API page, and say the database view was banned.
Practitioners using it
Posts on X from people describing a concrete use. The quote is the post. Likes and reposts are the counts saved with it, not a live total. A label marks a creator, a maintainer, a vendor, a partner, a data partner, or an investor.
"Checked 3 October 2026. Confirmed malware neighborhood, not just a DROP hit. 94.154.43.203 (Storm Industries AS219502, 1 discard) is on 48 aggregated lists, including URLhaus recent and 90-day, IPsum through level 7, https://t.co/Wq60gsHoZP SSH and telnet brute-force, and the…
Questions
Is URLhaus free?
The community API page says it is free under fair use. Commercial or for-profit use may require the enhanced abuse.ch API. No dollar price and no SPDX field were printed on 22 Oct 2026.
Did the URL database open in this review?
No. The browse and statistics URLs returned Varnish Error 405 Banned. The about page and the API page did open. The homepage is marketing cards.
Citations
07
Titled sources. These public pages are what the quotes on this listing come from.
Product
URLhaus homepage
https://urlhaus.abuse.ch/Documentation
URLhaus about
https://urlhaus.abuse.ch/about/Documentation
URLhaus community API
https://urlhaus.abuse.ch/api/