Threat feed
URLhaus Recent
Last fetched
Malware Distribution · refreshed hourly · last verified
URLhaus Recent is a Malware Distribution threat-intelligence feed, refreshed hourly, indexed by WhisperGraph. WhisperGraph currently records 2,652 indicators listed by it.
What is URLhaus Recent
URLhaus Recent is the abuse.ch URLhaus rolling-window feed of URLs (and underlying hosts) currently observed serving malware payloads. Source data is contributed by sandbox runs, the URLhaus contributor community, and abuse.ch's own malware-tracking pipelines; each entry includes the URL, the malware family or tag, and a first-seen timestamp. The recent view rolls older entries off so the feed reflects currently-live distribution infrastructure rather than archival material; a separate API exposes the full historical corpus. It is indexed here because URLhaus is one of the most widely-deployed open IOC feeds for malware distribution in 2026.
- Refresh cadence
- hourly
Category drift. The curated category for this feed is Malware Distribution, while WhisperGraph currently files it under malware-distribution.
Indicators currently listed
2,652 indicators across 3 node types.
HOSTNAME · 1,234
Related pages
Pivot from URLhaus Recent into the indicators it lists.
Queries
Resolves the feed's categories.
MATCH (f:FEED_SOURCE {name: $slug})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
WITH f, collect(c.name) AS categories
RETURN f.name AS slug, f.id AS id, categoriesThe indicator-kind rollup and sample listed above.
MATCH (f:FEED_SOURCE {name: $slug})<-[:LISTED_IN]-(x)
WITH labels(x)[0] AS kind, count(*) AS listed, collect(x.name)[0..5] AS sample
RETURN kind, listed, sample
ORDER BY listed DESCOr query Whisper from your own LLM workflow via the Whisper MCP server.