Security · template urlhaus

URLhaus Threat URLs

abuse.ch URLhaus malicious URL feed for security operations (connector template; consent terms apply for redistribution).

Query with MCP

After you have a tenant and API key, use run_sql (read-only) or unified_search. Example shape for this template:

SELECT event_type, created_at, source_id
FROM events
WHERE event_type = 'urlhaus.url'
LIMIT 20

Event types vary by sync configuration. Call get_schema or catalog on your tenant for live tables. Connector template id: urlhaus.

abuse.ch terms; see source ledger for servability notes. Servability and ingestion rules are documented in the source ledger.