Threat-intelligence feed
Malware DistributionLast verified Page fetched
URLhaus Recent is a malware distribution threat-intelligence feed tracked by WhisperGraph as a FEED_SOURCE node. The Whisper Internet Directory publishes this page so security analysts and LLM agents can link to it as a stable record for URLhaus Recent.
URLhaus Recent is the abuse.ch URLhaus rolling-window feed of URLs (and underlying hosts) currently observed serving malware payloads. Source data is contributed by sandbox runs, the URLhaus contributor community, and abuse.ch's own malware-tracking pipelines; each entry includes the URL, the malware family or tag, and a first-seen timestamp. The recent view rolls older entries off so the feed reflects currently-live distribution infrastructure rather than archival material; a separate API exposes the full historical corpus. It is indexed here because URLhaus is one of the most widely-deployed open IOC feeds for malware distribution in 2026.
Live data unavailable. WhisperGraph returned an error (WhisperGraph 524) while looking up this FEED_SOURCE node. The editorial content above is authoritative; the live-data check will retry on the next page revalidation.
Indicators: Computing — check back later. The precompute pipeline is building this feed's indicator sample from the host corpus and will populate the count and representative addresses on an upcoming run.
Look up which threat feeds list a given IP — the indicator-anchored query that powers the threat card:
MATCH (ip:IPV4 {name: $ip})-[:LISTED_IN]->(f:FEED_SOURCE)
WHERE f.name = "URLhaus Recent"
WITH f
MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
RETURN f.name AS feed, c.name AS categoryVerify the feed's graph-side identity directly:
MATCH (f:FEED_SOURCE {name: "URLhaus Recent"})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
RETURN f.id AS id, f.name AS name, c.name AS categoryOr query Whisper from your own LLM workflow via the Whisper MCP server.
Pivot from URLhaus Recent into adjacent entities.