URLhaus Database
Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).
Database Entry
| Host: | 09c1d5c3-1a6e-4c05-8e4e-eff75c6b5dd6.usrfiles.com |
|---|---|
| Domain registrar: | GoDaddy  |
| Domain registration date: | 2013-05-26 10:30:54 UTC |
| Spamhaus DBL : | Not blocked |
| SURBL : | Not blocked |
| Quad9 : | Blocked |
| AdGuard : | Not blocked |
| Cloudflare : | Not blocked |
| ProtonDNS : | Not blocked |
| OpenBLD : | Blocked |
| DNS4EU : | Not blocked |
| Control D HaGeZi : | Not blocked |
| Firstseen: | 2025-11-27 06:14:06 UTC |
| Total malware sites : | 4 |
| Online malware sites : | 0 (0%) |
| Offline Malware sites : | 4 (100%) |
| A record(s) observed : | 12 |
IP addresses
The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.
| Firstseen (UTC) | IP address | Hostname | SBL | ASN | Country | Active? |
|---|---|---|---|---|---|---|
| 2025-11-27 06:14:10 | 52.222.136.100 | server-52-222-136-100.fra50.r.cloudfront.net | Not listed | AS16509 AMAZON-02 | US | yes |
| 2025-11-27 06:14:10 | 52.222.136.105 | server-52-222-136-105.fra50.r.cloudfront.net | Not listed | AS16509 AMAZON-02 | US | yes |
| 2025-11-27 06:14:10 | 52.222.136.128 | server-52-222-136-128.fra50.r.cloudfront.net | Not listed | AS16509 AMAZON-02 | US | yes |
| 2025-11-27 06:14:10 | 52.222.136.3 | server-52-222-136-3.fra50.r.cloudfront.net | Not listed | AS16509 AMAZON-02 | US | yes |
| 2025-12-15 06:08:24 | 18.239.36.20 | server-18-239-36-20.ams58.r.cloudfront.net | Not listed | AS16509 AMAZON-02 | US | no |
| 2025-12-15 06:08:24 | 18.239.36.26 | server-18-239-36-26.ams58.r.cloudfront.net | Not listed | AS16509 AMAZON-02 | US | no |
| 2025-12-15 06:08:24 | 18.239.36.28 | server-18-239-36-28.ams58.r.cloudfront.net | Not listed | AS16509 AMAZON-02 | US | no |
| 2025-12-15 06:08:24 | 18.239.36.68 | server-18-239-36-68.ams58.r.cloudfront.net | Not listed | AS16509 AMAZON-02 | US | no |
| 2026-01-06 01:08:13 | 13.226.155.10 | server-13-226-155-10.dus51.r.cloudfront.net | Not listed | AS16509 AMAZON-02 | US | no |
| 2026-01-06 01:08:14 | 13.226.155.42 | server-13-226-155-42.dus51.r.cloudfront.net | Not listed | AS16509 AMAZON-02 | US | no |
Malware URLs
The table below shows all malware URLs that are associated with this particular host.
| Dateadded (UTC) | URL | Status | Tags | Reporter |
|---|---|---|---|---|
| 2026-01-20 16:08:07 | https://09c1d5c3-1a6e-4c05-8e4e-eff75c6b5dd6.us... | Offline | ps1 | Anonymous |
| 2025-12-22 06:55:09 | https://09c1d5c3-1a6e-4c05-8e4e-eff75c6b5dd6.us... | Offline |  skocherhan | |
| 2025-12-18 10:19:08 | https://09c1d5c3-1a6e-4c05-8e4e-eff75c6b5dd6.us... | Offline | ascii powershell ps1 |  abuse_ch |
| 2025-11-27 06:14:10 | https://09c1d5c3-1a6e-4c05-8e4e-eff75c6b5dd6.us... | Offline |  juroots |
The table below shows recent payloads delivery by this host.
| Firstseen (UTC) | SHA256 hash | File type | Bazaar | Signature |
|---|---|---|---|---|
| 2025-11-27 06:14:10 | 01369873e05c50b832072a4e3d385595d13d607fb8eb26b4c6a202b4001f8d43 | txt |