urlhaus

v0.1.0Verified publisher

Looks up a URL, domain, IP address or file hash in abuse.ch URLhaus: malware URLs, their status, tags and payloads

Run

TerminalAgent

Through ot mcp, an agent calls run_tool with this; ot asks you before anything that goes online or touches a target. Set it up: ot mcp install claude (or cursor, vscode, codex, gemini).

{"tool":"osintverse-community/urlhaus"}

Or just say: "Run osintverse-community/urlhaus on … with OTInstaller." The registry's read-only MCP server at api.otinstaller.com/mcp can find tools without installing anything.

ot run osintverse-community/urlhaus --format table

ot install osintverse-community/urlhaus

Docker image in a read-only container · talks to urlhaus-api.abuse.ch · needs ABUSECH_AUTH_KEY · up to 1 min. The first ot run installs the tool after asking once. Drop --format table for JSON.

Don't have ot? Install it in one line

macOS / LinuxWindows

curl -fsSL https://get.otinstaller.com/ot | sh

What this script does

Downloads the latest ot release for your machine from GitHub Releases.
Checks its SHA-256 against checksums.txt, and the Ed25519 signature on that file against the key built into the script.
Puts ot in /usr/local/bin or ~/.local/bin. Nothing else is written. Read the script.

irm https://get.otinstaller.com/ot.ps1 | iex

What this script does

Downloads the latest ot release for your machine from GitHub Releases.
Checks its SHA-256 against checksums.txt, and the Ed25519 signature on that file against the key built into the script.
Puts ot in %LOCALAPPDATA%\Programs\ot, and adds it to your PATH. Nothing else is written. Read the script.

Evidence

Security tab →

Pinnedimage sha256:7a45aa8d…74c56e. The same bytes on every install; ot pulls by digest, never by tag.
Signedby https://github.com/osintverse-community/urlhaus/.github/workflows/otinstaller-release.yml@refs/heads/main via token.actions.githubusercontent.com, verified by the registry on 24 Oct 2026. ot checks the same identity before every install and refuses another signer.
Scanned24 Oct 2026: 0 critical, 44 high, 63 medium, 62 low vulnerabilities; 0 embedded secrets, 0 malware heuristics; SBOM with 89 packages.
Workssmoke test passed on 24 Oct 2026 (exit 3 in 3.2 s, offline sandbox); the nightly health check has not run yet.
Backed upa copy of this image is on the registry's mirror. If the original registry refuses it, ot pulls the same digest from the mirror and checks the same signature.
Reviewedosintverse-community is a verified publisher: the registry confirmed who runs it, and a person reviewed its first release against the acceptable-use rules.

From the community

Issues →

Not health-checked yet; 0.1.0 came out today; nobody has said yet whether it works.

0.1.0 is in its first week. Nobody has said whether it works yet.

Used 0.1.0?It's broken for me

What you get back

Result envelope →

{
  "envelope": 1,
  "tool": "osintverse-community/urlhaus@0.1.0",
  "runtime": "docker",
  "input": {},
  "started_at": "2026-10-21T09:00:00Z",
  "duration_ms": 4100,
  "exit_code": 0,
  "entities": [
    {
      "type": "url",
      "value": "https://example.com/page"
    },
    {
      "type": "domain",
      "value": "example.com"
    },
    {
      "type": "ip",
      "value": "192.0.2.1"
    }
  ],
  "warnings": []
}

Every tool returns this shape, shaped here from what this tool declares it finds. --format table to read it; ot extract and ot auto to continue.

urlhaus

Looks up a URL, a host (domain or IP address) or a file hash in URLhaus, abuse.ch's shared database of URLs used to spread malware. A URL comes back with whether it is listed and still online, its threat type, tags, reporter, the date it was added, its listings on Spamhaus DBL and SURBL, and the files (payloads) it served. A host comes back with how many malware URLs it had and the URLs themselves, and a file hash with the file's type, size, malware family and the URLs that served it. Only URLhaus's database is read, so the target is not contacted.

ot run osintverse-community/urlhaus --domain example.com

Inputs

Give exactly one.

Input	Required
`url`	one of these	URL, exactly as URLhaus lists it
`domain`	one of these	Host name: the malware URLs on it
`ip`	one of these	IP address: the malware URLs on it
`hash`	one of these	MD5 or SHA-256 of a file: the URLs that served it

Keys

ABUSECH_AUTH_KEY, set with ot keys set ABUSECH_AUTH_KEY: the free Auth-Key from the abuse.ch authentication portal, https://auth.abuse.ch/, which MalwareBazaar and ThreatFox use too. abuse.ch's terms make its platforms free for not-for-profit use; commercial users may need a paid subscription through Spamhaus. Without the key the tool exits with code 3.

Notes

A target URLhaus has never listed gives no entities and a note on stderr. A host lookup matches that exact host, not its subdomains, and a URL lookup matches the URL character for character. URLhaus lists at most 100 URLs or payloads for one target. SHA-1 hashes can't be looked up; a value URLhaus rejects as invalid exits with code 2.

Next steps

Look a payload up in osintverse-community/malwarebazaar or osintverse-community/virustotal, or check a host's other reports with osintverse-community/otx-indicators.

Development

python -m unittest
ot validate

Releases are built, signed and published by the otinstaller release workflow (Actions tab, with the version to release).

License

MIT

What next

urlhaus finds url, domain, ip, document. Tools that take those:

url → 10 tools domain → 10 tools ip → 10 tools ot auto, with a saved result

Other url tools

All url tools →

Alternatives to urlhaus that also take an url; ot auto runs every installed one on the same value.