URLhaus Has a Free API — Check If Any URL Is Malicious (With Python)

#api #python #webdev #security

You know that feeling when someone sends you a link and you're not sure if it's safe?

There's a free API for that. URLhaus by abuse.ch maintains a database of malicious URLs — phishing sites, malware distributors, C2 servers — and lets you check any URL against it. No API key needed.

Quick Start

import requests

def check_url(url):
    """Check if a URL is in the URLhaus malware database."""
    resp = requests.post(
        'https://urlhaus-api.abuse.ch/v1/url/',
        data={'url': url}
    )
    data = resp.json()
    if data['query_status'] == 'no_results':
        return {'status': 'clean', 'url': url}
    return {
        'status': 'MALICIOUS',
        'url': url,
        'threat': data.get('threat', 'unknown'),
        'tags': data.get('tags', []),
        'date_added': data.get('date_added', ''),
        'reporter': data.get('reporter', '')
    }

# Check a URL
result = check_url('http://example.com')
print(f'Status: {result["status"]}')

What URLhaus Tracks

1M+ malicious URLs in database
Phishing sites
Malware download links
Command & Control (C2) servers
Cryptomining malware distributors

Batch Check Multiple URLs

urls_to_check = [
    'http://example.com',
    'http://suspicious-site.xyz',
    'https://legit-company.com',
]

for url in urls_to_check:
    result = check_url(url)
    emoji = '❌' if result['status'] == 'MALICIOUS' else '✅'
    print(f'{emoji} {url}: {result["status"]}')

Build a URL Safety Checker

Combine URLhaus with VirusTotal and Google Safe Browsing for comprehensive protection:

def full_url_check(url):
    """Check URL against multiple threat databases."""
    results = []

    # URLhaus (free, no key)
    uh = check_url(url)
    results.append(('URLhaus', uh['status']))

    # Add VirusTotal, HIBP, etc.
    # ...

    is_safe = all(r[1] == 'clean' for r in results)
    return {'url': url, 'safe': is_safe, 'checks': results}