URL Reputation Checker
Check if a URL or domain is known malware or phishing infrastructure using the URLhaus abuse.ch database. Provides threat classification, malware type, tags, and reporter information for flagged URLs.
How to Use URL Reputation Checker
- 1Enter a URL or domain name to check.
- 2The tool queries the URLhaus abuse.ch database for known malware and phishing URLs.
- 3Threat classification, malware type, tags, and status are returned.
- 4Clean results mean the URL was not found in the database — not a guarantee of safety.
Zenovay
Track your website performance
Real-time analytics, session replay, heatmaps, and AI insights. 2-minute setup, privacy-first.
Related Tools
Password GeneratorGenerate strong, random passwords with customizable length, characters, and complexity.
Password Strength CheckerCheck how strong your password is. Get an estimated crack time and improvement suggestions.
HMAC GeneratorGenerate HMAC signatures using SHA-256, SHA-384, or SHA-512 with the Web Crypto API.
AES Encryption/DecryptionEncrypt and decrypt text using AES-GCM with PBKDF2 key derivation. Runs entirely in your browser.
Frequently Asked Questions
What database does this tool check against?▾
This tool queries URLhaus by abuse.ch — a threat intelligence project that tracks URLs used to distribute malware. URLhaus focuses on URLs actively used for malware distribution, including botnet command-and-control (C&C) servers, drive-by-download sites, and phishing pages. The database is maintained by the security community and updated in real-time. URLhaus data is used by security vendors, ISPs, and threat intelligence platforms worldwide. Note: a "not found" result means the URL is not in URLhaus — it does not guarantee the URL is safe.
What threat types does URLhaus track?▾
URLhaus classifies threats into types: malware_download (URL distributes malware files), botnet_cc (botnet command-and-control server), phishing (credential harvesting), elf (Linux/Unix malware), exe (Windows executable), js (JavaScript malware), doc/xls/pdf (document-based malware), apk (Android malware). The url_status field shows whether the URL is currently online (active threat) or offline (historical threat).
My URL shows as "not in database" — does that mean it's safe?▾
No — a negative result means URLhaus has no record of this specific URL being used for malware distribution. URLhaus focuses specifically on malware distribution URLs and may not cover all phishing sites, scam sites, or newly registered malicious domains. For comprehensive URL safety checking, use multiple sources: Google Safe Browsing (check via browser), VirusTotal (comprehensive multi-AV scanning), and other threat intelligence feeds. URLhaus is most useful for checking if a URL is a known, reported malware distribution point.
What is Google Safe Browsing status?▾
URLhaus cross-references its database with Google Safe Browsing — Google's service that identifies dangerous websites. If the GSB field shows "listed", Google has flagged this URL as dangerous, which means Chrome, Firefox, and Safari users will see a warning when visiting it. A GSB listing indicates the threat is confirmed by Google's detection systems in addition to the community reporting in URLhaus.
Can I use this to check URLs in my email or chat messages?▾
Yes — paste the full URL (including http:// or https://) or just the domain. This is useful for: (1) Checking suspicious links before clicking them, (2) Verifying URLs in phishing email analysis, (3) Checking URLs reported by users as suspicious, (4) Security awareness training examples. For links in emails, always check the actual destination URL (hover to see, or use a URL expander for shortened links) rather than the displayed text. URLhaus covers known malware distribution URLs but may not have newly registered phishing sites.