# osintverse-community/urlhaus

Looks up a URL, domain, IP address or file hash in abuse.ch URLhaus: malware URLs, their status, tags and payloads

## Install and run

```sh
ot install osintverse-community/urlhaus
ot run osintverse-community/urlhaus url:http://example.com/bins/x.arm7
ot run osintverse-community/urlhaus d:example.com
ot run osintverse-community/urlhaus ip:8.8.8.8
```

The first `ot run` installs the tool after asking once. New to `ot`? See https://otinstaller.com/docs/getting-started.

From an AI agent, through ot's MCP server (`ot mcp`):

```
run_tool {"tool":"osintverse-community/urlhaus","inputs":{"url":"http://example.com/bins/x.arm7"}}
```

## Inputs

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `url` | url | no |  | URL, exactly as listed (give exactly one of url, domain, ip or hash) |
| `domain` | domain | no |  | Host name: the malware URLs on it (give exactly one of url, domain, ip or hash) |
| `ip` | ip | no |  | IP address: the malware URLs on it (give exactly one of url, domain, ip or hash) |
| `hash` | hash | no |  | MD5 or SHA-256 of a file: the URLs that served it (give exactly one of url, domain, ip or hash) |

## Outputs

Finds: url, domain, ip, document.

- `url`: Listed malware URLs, with status, threat, tags, reporter and date added
- `document`: Malware files (payloads): hashes, file type, size, family and first seen date

## What a run does

- Does not contact the target.
- Does not collect personal data.
- Needs an account (it logs in, or uses an account or API key of yours).
- Does not notify the target.
- Usually takes about 2 seconds.
- Connects to urlhaus-api.abuse.ch.

An agent needs the person's consent before running this tool, because it uses the person's own account or API key. See https://otinstaller.com/docs/agents#consent.

## API keys

- `ABUSECH_AUTH_KEY` (required, free): Your abuse.ch Auth-Key, free from the abuse.ch authentication portal (URLhaus, MalwareBazaar and ThreatFox share it) Get one at https://auth.abuse.ch/

Store a key with `ot keys set NAME`; it stays in the OS keychain.

## Trust

- Latest version: 0.1.0
- Signed: yes
- Verified publisher: yes
- Health: unknown
- Installs in the last 30 days: 0
- License: MIT
- Runtime: Docker image, pinned by digest
- Repository: https://github.com/osintverse-community/urlhaus

## Links

- Web page: https://otinstaller.com/osintverse-community/urlhaus
- JSON: https://api.otinstaller.com/v1/tools/osintverse-community/urlhaus
- README: https://github.com/osintverse-community/urlhaus#readme
- Security details: https://otinstaller.com/osintverse-community/urlhaus/security
- Report a problem: https://otinstaller.com/osintverse-community/urlhaus/report