URLhaus Malware URLs Scraper

URLhaus Malware URLs Scraper

Scrape malware URLs from URLhaus, the abuse.ch threat intelligence feed, up to a million per run. Every entry includes the URL, threat tags, file hashes, and submission date. Export to CSV, JSON, Excel, or XML.

URLhaus is a community-driven project from abuse.ch that collects and shares malware distribution sites. Security teams need its data to block threats, but manually downloading and parsing the daily feeds is slow. This Actor pulls the public URLhaus feed directly, returning a clean dataset of malicious URLs with their associated payload hashes and threat classifications.

Who uses it	What they scrape URLhaus by abuse.ch for
SOC analysts	Ingest a daily list of active malware distribution URLs into a SIEM or blocklist.
Threat intelligence teams	Enrich internal alerts with URLhaus threat tags and associated malware family names.
Incident responders	Check if a suspicious URL in a case is a known malware host.
Security researchers	Track the infrastructure and payload hashes of a specific malware campaign over time.

What it does

This Actor collects malware URLs from the URLhaus feed and returns each entry as a flat row with the URL, threat tags, file hashes, and submission timestamp.

• 🕒 Recent feed: Pulls every URL submitted to URLhaus in the last 30 days.
• 🟢 Currently online feed: Returns only the malicious URLs that are still reachable right now.

Results export to CSV, JSON, Excel, or XML, or straight from the API.

What you can do with URLhaus by abuse.ch data

🛡️ Feed a blocklist.

A SOC analyst runs the Actor daily for the recent feed, exports the URLs to CSV, and pushes them into the corporate web proxy blocklist.

🔍 Enrich an alert.

A threat hunter takes a suspicious URL from a SIEM alert, runs the Actor with a small maxItems, and checks if the URL appears in the URLhaus dataset with known malware tags.

📊 Track a campaign.

A researcher scrapes the full 30-day feed, filters for a specific malware family in the threat tags, and maps the distribution infrastructure.

⚡ Prioritize live threats.

An incident responder uses the currently online feed to focus triage on malicious URLs that are still actively serving malware.

Why choose this scraper

	What you get
No API key required	Reads the public URLhaus data dumps directly, no registration needed.
Two feed modes	Get the full 30-day history or only the URLs that are still online at scan time.
Fixed, flat schema	Every row has the same columns: URL, threat tags, file hashes, and submission date.
High-volume ready	Set maxItems up to 1,000,000 and let the Actor run until it hits your limit.

How it compares

No other Store actor targets URLhaus by abuse.ch the same way, so the honest comparison is with the alternatives teams actually weigh.

	URLhaus Malware URLs Scraper	Build it in-house	By hand
Setup	Run it now, zero config	Days of engineering	None, but hours per pull
When URLhaus by abuse.ch changes	Maintained for you	You fix it	You re-learn the page
Proxies, retries, anti-bot	Built in	Your problem	Browser only
Output	Fixed JSON schema, CSV/Excel export	Whatever you build	Copy-paste
Cost	Pay per result	Engineering time	Analyst hours

Configure the run

Choose the feed type and set a maximum number of URLs to collect, from a single sample up to a million. The Input tab lists every parameter.

A first run with the defaults:

{
 "maxItems": 10
}

A larger pull:

{
 "maxItems": 200
}

Pricing

Pay-per-result: $0.021 per result collected. You pay only for the results written to your dataset.

Results collected	Approximate cost
100 results	$2.10
1,000 results	$21.00
10,000 results	$210.00

New Apify accounts start with $5 in free credit.

Free users

Free-plan runs return up to 10 results as a preview. Upgrade your Apify plan to collect up to 1,000,000 results per run.

Run it

1. Create a free Apify account with $5 in credit.
2. Open the URLhaus Malware URLs Scraper.
3. Set your inputs and any filters, then click Start.
4. Export the results as CSV, Excel, JSON, or XML from the Dataset tab.

Run it programmatically through the Apify API (run-sync-get-dataset-items) or the ApifyClient for JavaScript and Python.

Use with AI agents (MCP)

Give an AI agent live access to URLhaus by abuse.ch through the Model Context Protocol. Add the Actor to Claude, Cursor, or any MCP client:

$claude mcp add --transport http apify "https://mcp.apify.com?tools=parseforge/urlhaus-malware-urls-scraper"

Then prompt it in plain language to run the scraper and read back the results.

Troubleshooting

Why am I getting no results?

Check that you have selected a feed type. The online feed can be empty if no recently submitted URLs are still reachable. Try switching to the recent feed, which always contains the last 30 days of submissions.

The run stops before reaching my maxItems limit.

The Actor stops when it has read all available entries in the chosen feed. If the feed contains fewer URLs than your maxItems setting, the run will finish early with the available data.

Can I get only URLs for a specific threat tag?

The Actor returns the complete feed. To filter for a specific tag like Emotet, export your dataset and filter the threat tags column in a spreadsheet or with a simple script.

How do I automate this to run every day?

Use Apify Schedules. Set the Actor to run on a cron schedule, such as once per day, and configure the run to push the dataset to your storage or SIEM via an Apify integration.

FAQ

Question	Answer
What is URLhaus?	URLhaus is a project from abuse.ch that collects, tracks, and shares malware distribution URLs submitted by the security community. It is a widely used open threat intelligence feed.
Do I need an API key to scrape URLhaus?	No. This Actor reads the public data dumps that URLhaus provides, so no registration or API key is required.
What is the difference between the recent and online feeds?	The recent feed contains every URL submitted in the last 30 days. The online feed returns only the subset of those URLs that were still reachable and serving malware at the time of the last URLhaus scan.
What data does each row contain?	Each row includes the malicious URL, threat tags assigned by URLhaus, associated file hashes like SHA256, and the date the URL was submitted.
How many URLs can I scrape in one run?	You can set the maximum from 1 up to 1,000,000 URLs. The Actor stops when it reaches your limit or the end of the feed.
Can I filter for a specific malware family?	The Actor returns the full feed. You can filter the output dataset in your own tools by the threat tags field, which contains malware family names like Emotet or BazarLoader.
How often is the URLhaus data updated?	URLhaus updates its public feeds continuously as new submissions arrive. You can schedule this Actor to run hourly or daily to stay current.
What export formats are supported?	You can export your results to CSV, JSON, Excel, or XML from the Apify dataset tab.
Is this Actor suitable for a production blocklist pipeline?	Yes. Security teams commonly schedule it to run daily, export the CSV, and ingest the URLs into firewalls, proxies, or DNS filters.
Does this Actor download the malware samples?	No. It collects only the metadata about the URLs and the associated file hashes. It does not fetch or execute any payloads.

Related actors

Browse the full ParseForge collection for more scrapers.

🆘 Need help? Email parseforge@protonmail.com with your run ID, your input, and what you expected.

⚠️ Disclaimer. This Actor is unofficial and is not affiliated with, endorsed by, or sponsored by abuse.ch. It collects only publicly available data. You are responsible for using the collected data in compliance with the source's terms of service and applicable data-protection laws, including GDPR, CCPA, and PIPL. Do not use it to collect personal data unlawfully.