Check any URL against the URLhaus malware database
This free URL malware check lets you scan links against URLhaus, the community malware-URL database run by abuse.ch. Paste a suspicious link and the tool checks it against URLhaus's records of URLs known to distribute malware. It reports a clear status — no threats found or threat detected — along with the threat type, the date the URL was first reported, the number of associated malware payloads, and any tags describing the campaign or malware family.
URLhaus is a respected open threat-intelligence source focused specifically on malware-distribution URLs. Checking a link against it before visiting is a quick triage step for analysts handling phishing reports, suspicious attachments, or unfamiliar shortened links. A match is high-confidence evidence that a URL has been used maliciously; the reporting date and payload count help gauge how active and how dangerous the link has been.
Enter a full URL (for example https://example.com/path). A green no threats found result means the URL is not currently listed in URLhaus — but because the database covers known malware URLs only, an unlisted link is not proof of safety, merely the absence of a known bad record. A red threat detected result, with a threat type and tags, is a strong signal to avoid the link and treat any system that already opened it as potentially exposed. Use this as one input alongside other reputation and sandbox checks rather than a sole verdict.
Investigate the host behind a flagged link with the domain DNS and email-security scanner and the WHOIS and RDAP domain lookup, and check whether the domain has appeared in known breaches via the email breach exposure checker.
URLhaus is an open threat-intelligence project by abuse.ch that collects and shares URLs known to be used for distributing malware. Security teams worldwide submit and consume its data to block and investigate malicious links.
Not necessarily. A clean result means the link is not in the URLhaus malware database. New or targeted malicious URLs may not yet be listed, so treat a clean result as the absence of a known threat rather than a guarantee of safety.
Yes. The tool only sends the URL as a text query to check it against the database — it does not open, visit, or execute the link in your browser. No queries are logged, so you can check a suspect link without exposing your own system to it.