🛡️ URLhaus Malware URLs Scraper

🚀 Pull URLhaus data in seconds. Active malware distribution URLs from URLhaus / abuse.ch with status, threat type, tags, payload, host, and country.

🕒 Last updated: 2026-05-27 · 📊 12 fields per record · Public data source · No login required

The URLhaus Malware URLs Scraper turns the public URLhaus dataset into a clean, structured pull. It hits the source directly with a real browser fingerprint and flattens results into a tabular/spreadsheet/tabular/tabular/tabular-ready shape.

Active malware distribution URLs from URLhaus / abuse.ch with status, threat type, tags, payload, host, and country.

🎯 Target Audience	💡 Primary Use Cases
🛡️ SecOps	Block known-bad URLs
📊 Threat intel	Enrich SIEM feeds
🤖 SecurityAI	Build malware corpora
📰 Researchers	Track malware campaigns

📋 What this scraper does

• Connects to the public URLhaus source.
• Applies your filters and pagination.
• Normalizes records into a flat row schema with imageUrl first and error last.
• Pull as tabular records, tabular, tabular, RSS, or HTML.

💡 Why it matters: the upstream source is free to browse, but you need clean rows for spreadsheets, BI tools, or LLM pipelines. This scraper does the plumbing.

🎬 Full Demo

🚧 Coming soon.

⚙️ Input

Open the Input tab in the Apify console to fill in your filters. Examples:

Example 1:

{
  "feed": "recent",
  "maxItems": 10
}

Example 2:

{
  "feed": "online",
  "maxItems": 100
}

⚠️ Good to Know: free users are capped at 10 items per run. Upgrade to a paid plan for up to 1,000,000 items per run. The scraper only returns what the public source actually exposes.

📊 Output

Each record is a flat object. imageUrl is always first, error is always last.

Field	Type	Description
imageUrl	string	null
urlId	string	URLhaus URL ID.
maliciousUrl	string	Malicious URL.
urlStatus	string	null
threat	string	null
tags	string	null
host	string	null
dateAdded	ISO 8601	null
reporter	string	null
sourceUrl	string	Canonical URL of this record on the source site.
scrapedAt	ISO 8601	When this row was scraped.
error	string	null

✨ Why choose this Actor

• 🚀 Fast: real HTTP fingerprint, no headless browser overhead.
• 🧱 Reliable: graceful error rows when the source returns nothing.
• 📊 Clean schema: spreadsheet-ready, no tabular gymnastics.
• 🌐 Free-tier friendly: 10-item preview, then paid plan unlocks the rest.

📈 How it compares to alternatives

Option	Setup time	Maintenance	Output shape
This actor	0 minutes	Zero	tabular / tabular / spreadsheet / tabular
Manual copy/paste	Hours	Constant	Spreadsheet
Custom scraper	Days	High	Whatever you build

🚀 How to use

1. Create a free account w/ $5 credit
2. Open this actor in the Apify console.
3. Fill in the input form and click Start.
4. Open your dataset as tabular records, tabular, tabular, RSS, or HTML.

💼 Business use cases

Market research

Pull a snapshot of the dataset to size a niche, benchmark competitors, or feed an investor deck.

Lead generation

Filter the source by category or region to build a clean prospect list.

Data enrichment

Join the output against your CRM to enrich existing records with public-source attributes.

Monitoring

Re-run on a schedule and diff against last run to catch new entries, removals, or status changes.

🔌 Automating URLhaus Malware URLs Scraper

Trigger this actor from Make, Zapier, n8n, Slack, Discord, Google Sheets, Airtable, Notion, or any HTTP-aware tool via the Apify API. Every run pushes to a dataset you can pipe straight into your warehouse.

🌟 Beyond business use cases

Academic research

Build a public-source corpus for a paper, dissertation, or class project.

Journalism

Investigate trends across the dataset with a paper trail you can cite.

Non-profits

Track regulatory or directory changes that affect the communities you serve.

Hobby projects

Power side projects, dashboards, and discord bots with fresh, real-world data.

🤖 Ask an AI assistant about this scraper

Paste this page URL into ChatGPT, Claude, or Gemini and ask:

• "What input parameters does 🛡️ URLhaus Malware URLs Scraper accept?"
• "Give me 3 use cases for the dataset this scraper produces."
• "Write a Python snippet that calls this actor via the Apify API."

❓ Frequently Asked Questions

❓ Do I need an API key for the source? No. The actor scrapes the public source directly.

❓ How many records can I get per run? Up to 10 on the free tier, up to 1,000,000 on paid plans.

❓ How fresh is the data? Every run hits the source live, the data is as fresh as the source publishes it.

❓ Can I run this on a schedule? Yes. Apify has built-in cron-style scheduling.

❓ What shape is the output? Flat tabular. Open as tabular, spreadsheet, tabular, tabular, RSS, or HTML from the dataset view.

❓ Do you support webhooks? Yes, configure Apify webhooks to fire on every successful run.

❓ Is this scraper legal? The scraper only reads public pages with a public-facing user agent, mirroring what a human would see in a browser. You are responsible for compliance with the source's terms when reusing the data.

❓ What happens if the source is down? The actor pushes a single {error: "..."} row so you still see why the run produced no data.

❓ Can I filter by date / region / category? See the Input tab, every supported filter is exposed there.

❓ Will the schema change? Backwards-compatible additions only. Removed fields are announced in the date bump.

🔌 Integrate with any app

Apify's API and SDKs (JS, Python, Go) let you wire this actor into Make, Zapier, n8n, Slack, Discord, Google Sheets, Airtable, Notion, Webflow, your own backend, or anything that speaks HTTP.

🔗 Recommended Actors

Actor	What it does
OurAirports Global Airport Database Scraper	Every airport on Earth, structured.
Google Patents Scraper	Patent search across 100+ jurisdictions.
FAA Aircraft Registry Scraper	US aircraft ownership and airworthiness.

💡 Pro Tip: browse the complete ParseForge collection for more public-data scrapers in the same style.

---

Disclaimer: This scraper accesses public data only. It does not bypass authentication, paywalls, or anti-bot systems. You are responsible for ensuring your use of the data complies with the source's terms of service and applicable law.