What we checkReputationRP-02
URLhaus
A public database of URLs observed distributing malware.
- Area
- Reputation
- Check
- RP-02
- Included
- Free in every scan
What we check
We ask URLhaus whether any URL on your domain is listed.
Why it matters
A URLhaus listing feeds numerous blocklists, so the effect reaches well beyond one database — mail filters and corporate proxies consume it.
As with Safe Browsing, a listing is usually the visible end of a compromise rather than the problem itself.
The listing also spreads. URLhaus feeds a number of downstream blocklists, so by the time you notice, the effect may already reach mail filters and corporate proxies that never consulted the original database.
How to fix it
- 1
Find what is being served. It is often an upload directory or an outdated plugin.
- 2
Remove it, then request removal at urlhaus.abuse.ch with evidence of the fix.
- 3
Check how the file got there before you close the incident — an upload form, an outdated plugin, or a stolen credential is still open, and re-listing is the usual outcome of cleaning only the symptom.
Common questions
- Someone uploaded a file to my site. Is that my fault?
- It is your responsibility to remove, whoever put it there. Look at how it was uploaded too — that route is still open.
- Can I be listed for a subdomain I do not control?
- Yes, and it is a common consequence of the dangling-subdomain problem DN-05 covers.
- Does a listing affect email?
- It can. Several mail filters consume the same feeds, so a web compromise can quietly damage deliverability.
See how your domain does on this check.
All 34 checks, a grade, and the exact fix for anything that isn’t right — in about twenty seconds, no signup.