# SiteCheck Web Intel – URLhaus Malware Host Lookup

> SiteCheck Web Intel – URLhaus Malware Host Lookup is a paid API for AI agents from api.webintel-api.workers.dev, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-24).

Checks whether a domain or IP address is listed on abuse.ch URLhaus as a malware distribution host, returning threat metadata, Spamhaus/SURBL status, and recent malicious URLs.

## Facts

- Endpoint: GET https://api.webintel-api.workers.dev/api/security/urlhaus-malware?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-24
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/sitecheck-web-intel-urlhaus-malware-host-lookup-69908470
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_tmXZs4RXA6MmhyiMHXeDF

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sitecheck-web-intel-urlhaus-malware-host-lookup-69908470
```

Example prompt: Can you check if the domain 221.15.252.30 is listed on URLhaus as a malware host — I want to know its threat type, how many malicious URLs it's been linked to, and whether it's on Spamhaus or SURBL blocklists?

## When to prefer this

Use this endpoint when you need to check a specific domain or IP against the abuse.ch URLhaus malware distribution database, especially when you also want Spamhaus DBL and SURBL status in one call. Prefer this over generic threat intel APIs when URLhaus coverage is specifically required — it is the canonical source for malware URL distribution data.

## Known failure modes

- Host not found in URLhaus database — clean or unknown host returns no record
- Invalid host format (e.g. IPv6, hostname typo) may return an error or empty result
- Rate limiting or upstream URLhaus API unavailability may cause timeouts
- Stale data — URLhaus records may lag real-time host activity by hours or days

## How this service works

Checks whether a host (domain or IP) is known to abuse.ch URLhaus as a malware distribution host: first seen, number of malware URLs, Spamhaus DBL / SURBL status and the latest URLs with status (online/offline), threat type, tags, reporter and URLhaus reference.

## Output

Returns URLhaus host record including: first-seen timestamp, total count of malware URLs hosted, Spamhaus DBL and SURBL blocklist status, and a list of recent associated URLs each with online/offline status, threat type (e.g. malware_download, botnet_cc), associated tags, reporter handle, and URLhaus reference link.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "host"
     ],
     "properties": {
      "host": {
       "type": "string",
       "description": "Domain or IPv4 address, e.g. 221.15.252.30 (required)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sitecheck-web-intel-urlhaus-malware-host-lookup-69908470/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.webintel-api.workers.dev](https://www.zero.xyz/host/api.webintel-api.workers.dev/llms.txt)