{"id":48124919,"url":"https://github.com/andpalmier/urlhs","last_synced_at":"2026-04-04T16:25:01.651Z","repository":{"id":346811612,"uuid":"1136809022","full_name":"andpalmier/urlhs","owner":"andpalmier","description":"CLI tool to search in URLhaus database and submit URLs","archived":false,"fork":false,"pushed_at":"2026-03-25T14:28:35.000Z","size":29659,"stargazers_count":2,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-03-26T17:12:01.376Z","etag":null,"topics":["threat-hunting","threat-intelligence","url-analysis","urlhaus"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"agpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/andpalmier.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-01-18T11:57:09.000Z","updated_at":"2026-03-25T14:28:53.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/andpalmier/urlhs","commit_stats":null,"previous_names":["andpalmier/urlhs"],"tags_count":2,"template":false,"template_full_name":null,"purl":"pkg:github/andpalmier/urlhs","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/andpalmier%2Furlhs","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/andpalmier%2Furlhs/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/andpalmier%2Furlhs/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/andpalmier%2Furlhs/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/andpalmier","download_url":"https://codeload.github.com/andpalmier/urlhs/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/andpalmier%2Furlhs/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31405700,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-04T10:20:44.708Z","status":"ssl_error","status_checked_at":"2026-04-04T10:20:06.846Z","response_time":60,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["threat-hunting","threat-intelligence","url-analysis","urlhaus"],"created_at":"2026-04-04T16:25:00.393Z","updated_at":"2026-04-04T16:25:01.647Z","avatar_url":"https://github.com/andpalmier.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# urlhs - URLhaus CLI Client\n\nA command-line tool for interacting with the [URLhaus API](https://urlhaus-api.abuse.ch/).\n\n\u003e **Part of the abuse.ch CLI toolkit** - This project is part of a collection of CLI tools for interacting with [abuse.ch](https://abuse.ch) services:\n\u003e - [urlhs](https://github.com/andpalmier/urlhs) - URLhaus (malware URL database)\n\u003e - [tfox](https://github.com/andpalmier/tfox) - ThreatFox (IOC database)\n\u003e - [yrfy](https://github.com/andpalmier/yrfy) - YARAify (YARA scanning)\n\u003e - [mbzr](https://github.com/andpalmier/mbzr) - MalwareBazaar (malware samples)\n\n[![Go Report Card](https://goreportcard.com/badge/github.com/andpalmier/urlhs)](https://goreportcard.com/report/github.com/andpalmier/urlhs)\n[![License: AGPL v3](https://img.shields.io/badge/License-AGPL%20v3-blue.svg)](https://www.gnu.org/licenses/agpl-3.0)\n\n## Features\n\n- ✅ Uses only Go standard libraries\n- 📝 JSON output for easy parsing\n- ⚡️ Built-in rate limiting (10 req/s)\n- 🐳 Docker, Podman, and Apple container support\n\n## Installation\n\n### Using Homebrew\n\n```bash\nbrew install andpalmier/tap/urlhs\n```\n\n### Using Go\n\n```bash\ngo install github.com/andpalmier/urlhs@latest\n```\n\n### Using Container (Docker/Podman)\n\n```bash\n# Pull pre-built image\ndocker pull ghcr.io/andpalmier/urlhs:latest\n\n# Or build locally\ndocker build -t urlhs .\n```\n\n### From Source\n\n```bash\ngit clone https://github.com/andpalmier/urlhs.git\ncd urlhs\nmake build\n```\n\n## Quick Start\n\n1. **Get your API key** from [abuse.ch Authentication Portal](https://auth.abuse.ch/)\n\n2. **Set your API key**:\n\n```bash\nexport ABUSECH_API_KEY=\"your_api_key_here\"\n```\n\n3. **Query recent URLs**:\n\n```bash\nurlhs recent -urls -limit 10\n```\n\n## Usage\n\n### Commands\n\n| Command | Description |\n|---------|-------------|\n| `recent` | Query recent URLs or payloads |\n| `query` | Query by URL, host, payload, tag, or signature |\n| `download` | Download malware sample by SHA256 |\n| `version` | Show version information |\n\n### Query Recent Data\n\n```bash\n# Recent URLs\nurlhs recent -urls -limit 50\n\n# Recent payloads\nurlhs recent -payloads -limit 50\n```\n\n### Query Information\n\n```bash\n# By URL\nurlhs query -url \"http://example.com/malware.exe\"\n\n# By host\nurlhs query -host example.com\n\n# By payload hash\nurlhs query -hash 12c8aec5766ac3e6f26f2505e2f4a8f2\n\n# By tag\nurlhs query -tag Emotet\n\n# By malware signature\nurlhs query -signature Gozi\n```\n\n### Download Samples\n\n```bash\nurlhs download -sha256 \u003csha256_hash\u003e\n```\n\n\u003e **Warning**: Downloaded files are NOT password protected and may trigger antivirus alerts.\n\n### Container Usage\n\n```bash\n# Run with Docker\ndocker run --rm -e ABUSECH_API_KEY=\"your_key\" ghcr.io/andpalmier/urlhs recent -urls -limit 10\n\n# Run with Podman\npodman run --rm -e ABUSECH_API_KEY=\"your_key\" ghcr.io/andpalmier/urlhs recent -urls -limit 10\n\n# Run with Apple container\ncontainer run --rm -e ABUSECH_API_KEY=\"your_key\" ghcr.io/andpalmier/urlhs recent -urls -limit 10\n\n# Mount volume for downloads\ndocker run --rm -e ABUSECH_API_KEY=\"your_key\" -v $(pwd):/data ghcr.io/andpalmier/urlhs download -sha256 \u003chash\u003e\n```\n\n## Environment Variables\n\n| Variable | Description |\n|----------|-------------|\n| `ABUSECH_API_KEY` | Your abuse.ch API key (required) |\n\n## License\n\nThis project is licensed under the AGPLv3 License - see the [LICENSE](LICENSE) file for details.\n\n## Acknowledgments\n\n- [URLhaus](https://urlhaus.abuse.ch) by abuse.ch\n- [abuse.ch](https://abuse.ch) for their work in fighting malware\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fandpalmier%2Furlhs","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fandpalmier%2Furlhs","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fandpalmier%2Furlhs/lists"}