Source we aggregate
isMalicious + URLhaus
abuse.ch malware URL blocklist. isMalicious consumes this source and correlates it with others. Here is what that adds, and when to go direct.
URLhaus is one of the sources isMalicious aggregates
We do not replace URLhaus. Rows where isMalicious shows a capability URLhaus lacks mostly come from the aggregation layer; for URLhaus’s core use case, use URLhaus directly.
Quick verdict
Choose URLhaus for a free, focused malware URL feed. Choose isMalicious for IP, domain, URL and hash reputation in one API, with confidence scoring, STIX/TAXII and CVE data.
isMalicious
Threat intelligence API with multi-source correlation, CVE data and ransomware leak-site tracking.
Best for: Automated threat intelligence at scale
URLhaus
URLhaus is a free abuse.ch project that tracks malware distribution URLs. Teams download its CSV blocklists or query its API; it covers URLs only.
Best for: Free malware URL blocklist ingestion
Feature comparison
| Feature | isMalicious | URLhaus |
|---|---|---|
| Malware URL blocklist | ||
| IP reputation API | ||
| Domain reputation API | ||
| File hash analysis | Partial | |
| Multi-source confidence scoring | ||
| Bulk API | Limited | |
| STIX/TAXII export | ||
| Ransomware leak-site tracking | ||
| CVE intelligence (CVSS, EPSS, KEV) | ||
| Streaming threat feed | ||
| Free tier available |
Check this table against your own indicators.
Run a free reportURLhaus: strengths and limitations
- Free malware URL blocklist
- Fast community reporting
- Simple CSV/API export
- Trusted abuse.ch brand
- URL/malware focus only — no IP reputation API
- No domain WHOIS or DNS enrichment
- No CVE or ransomware intelligence
- No STIX/TAXII enterprise feeds
- No confidence scoring across configured sources
Pricing
isMalicious
Free: website lookups with no monthly cap and 250 API calls a month. Pro from €99/month. Enterprise custom pricing.
View pricing →URLhaus
Free (community project)
Frequently asked questions
Does isMalicious include URLhaus data?
Is URLhaus enough for enterprise firewall blocking?
Which is better for SOC automation?
Other comparisons
Decide with your own data
Don't take our word over URLhaus's. Check something real.
Paste an IP, domain or URL: reputation, WHOIS, DNS, ransomware signals and an AI-generated assessment. Free, no signup.
- 250 free API calls/month
- No credit card required
- API key in under 2 minutes