Support Library

Malware on Your Website: URLhaus Listings and Cleanup

URLhaus is a public database, run by abuse.ch, of web addresses that hand out malware. Security tools, browsers and network filters use it to block those addresses. If it lists links on your domain, someone has placed malicious files on your site, almost always through a stolen password or an unpatched CMS, plugin or server.

Author
CategoryWebsite Security
Length4 minute read
UpdatedNovember 1, 2026

The short answer

Treat it as a compromise, not a false alarm. Take the malicious files offline, find out how they got there, close that hole, change every password that could reach the site, and then confirm with URLhaus and Google Safe Browsing that the warnings are gone.

How a site ends up serving malware

How an attacker turns a hacked website into a malware download site, and how cleanup ends it Top, compromised: an attacker gets in through an outdated plugin or a stolen login, uploads a malware file under the site’s domain, and sends links to it in phishing mail. URLhaus records the link and filters start blocking the domain. Bottom, cleaned: the team removes the files, patches the entry point and resets credentials; URLhaus marks the URLs offline and the warnings stop. Compromised Way in Old plugin or password Malware uploaded /wp-content/x.zip Links sent out In phishing mail Domain blocked URLhaus and filters Visitors infected from your domain Mail and links blocked Cleaned up Files removed From the web root Hole closed Patched, passwords reset URLs go offline URLhaus re-checks Warnings lifted Review requested Nothing left to download Attacker cannot return How an attacker turns a hacked website into a malware download site, and how cleanup ends it Top, compromised: an attacker gets in through an outdated plugin or a stolen login, uploads a malware file under the site’s domain, and sends links to it in phishing mail. URLhaus records the link and filters start blocking the domain. Bottom, cleaned: the team removes the files, patches the entry point and resets credentials; URLhaus marks the URLs offline and the warnings stop. Compromised Way in Old plugin or password Malware uploaded /wp-content/x.zip Links sent out In phishing mail Domain blocked URLhaus and filters Visitors infected from your domain Mail and links blocked Cleaned up Files removed From the web root Hole closed Patched, passwords reset URLs go offline URLhaus re-checks Warnings lifted Review requested Nothing left to download Attacker cannot return
Attackers favour real, trusted domains for hosting malware because mail filters and users trust them more than new ones.

How DNS Panopticon detects it

Security Posture asks URLhaus about the scanned domain. The result appears on the IP and Asset Reputation card.

FindingSeverityWhen it appears
Site is serving malware (URLhaus)CriticalURLhaus lists malware URLs on the domain that are still online. Caps the overall grade.
Past malware URLs in URLhausMediumURLhaus has malware URLs on the domain, but none still online.
No malware URLs in URLhausPassURLhaus has nothing for the domain.
URLhaus could not be checkedNot gradedURLhaus did not answer.

URLhaus covers malware distribution. Phishing pages and spam are covered by the domain blocklists described in Blocklisted Domains and IP Addresses.

How to check it yourself

Page or commandWhat it tells you
https://urlhaus.abuse.ch/host/example.com/Every URL URLhaus has on the domain, with first-seen date, status (online or offline) and the malware family.
https://transparencyreport.google.com/safe-browsing/search?url=example.comWhether Google Safe Browsing currently warns visitors about the site.
curl -sI https://example.com/path/from/urlhausWhether a listed URL still returns a file (200) or is gone (404 or 410).

In Google Search Console, the Security issues report lists the pages Google found and is where you request a review.

Why it matters

  • People get infected from your name. Visitors and anyone receiving the links trust your domain, so the malware spreads further.
  • Your domain is blocked. Browsers, mail filters and corporate proxies that use URLhaus or Safe Browsing block or warn on the whole site, including legitimate pages.
  • The attacker is still in. Whoever uploaded the file usually left a back door, such as a web shell or an admin account, to come back.
  • Past listings still count. Offline URLs show the site was compromised once, which matters to anyone assessing your security.

How to clean up

  1. Take a snapshot of files, databases and logs for investigation, then put the site into maintenance mode or restrict access if the infection is active.
  2. Remove the malicious files listed on URLhaus, and search for others: recently changed files, PHP files in upload folders, unknown admin users and scheduled tasks.
  3. Find the way in. Check web server and CMS logs around the first-seen date. Common causes are outdated plugins or themes, reused or phished passwords, and exposed admin panels.
  4. Close it. Update the CMS, plugins, themes and server software (see Known Vulnerabilities), remove anything unused, and reset every password: hosting, FTP or SFTP, database, CMS admins and API keys.
  5. If in doubt, rebuild from a known-clean backup or fresh install, then restore content only.
  6. Get warnings lifted. URLhaus marks URLs offline when its checks see them gone; you can also report a takedown through its site. Request a review in Google Search Console for Safe Browsing warnings.
  7. Prevent a repeat with automatic updates, MFA on admin accounts, a web application firewall and file-change monitoring.

FAQ

The listed URLs return 404 now. Are we done?

Only if you also found and closed the way in. Attackers often keep access and upload new files later. Check for web shells, unknown accounts and the original vulnerability before considering it closed.

Will the past listing ever disappear?

URLhaus keeps a history of what it has seen, so offline URLs stay on record. DNS Panopticon counts them as a smaller, medium finding. What matters is that nothing is online and the cause is fixed.

Our host says the site is clean. Why is it still listed?

Check that every listed URL really returns 404 or 410 and that a CDN cache is not still serving the file. URLhaus re-checks URLs regularly and updates their status.

Sources and further reading

Related support articles

Blocklisted Domains and IP AddressesKnown Vulnerabilities (CVEs) in Website SoftwareEnd-of-Life and Outdated Website SoftwareContent-Security-Policy