URLhaus, a public malware database run by abuse.ch, lists files on the domain that spread malware. That almost always means the website has been hacked, and firewalls and security tools that use the list may block it.
What it means
Security researchers report addresses that serve malware, such as infected downloads or scripts, to URLhaus, and its list feeds firewalls, antivirus software and DNS filters. Only listings URLhaus still marks as online count; old listings that are now offline show in the website’s Website health section but don’t raise this issue.
What triggers it
Once a day the Blacklist & malware check asks URLhaus about the website’s domain. Any active listing raises this Critical issue with the number of files, and owners and admins are alerted by email and chat straight away, then again when the number changes or a week later if it’s still listed.
This part of the check needs a URLhaus auth key, saved in the Blacklist & malware dialog on Data connections.
Common causes
- An out-of-date CMS, theme or plugin let attackers inject code, redirects or files.
- Stolen admin, hosting or FTP passwords.
- Another website on the same hosting account was hacked and used to reach this one.
How to fix it
- Search for the domain at urlhaus.abuse.ch to see the exact addresses listed.
- Delete those files and anything else you don’t recognise, check for unknown admin users, and restore a clean backup if needed.
- Update the CMS, themes and plugins, and change every password: CMS admins, hosting, FTP and database.
- URLhaus rechecks listed addresses and marks them offline once they stop serving malware. If one stays online after cleaning, ask abuse.ch to look again.
When it clears
The issue clears at the first daily check after URLhaus marks every listed address offline. If Google flags the website too, see Google flags the website as dangerous.
If you mark the action done and the problem is still found 14 days later, it comes back as “Fix didn’t work”. See Using the action plan.