URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2023-03-08 21:08:13	103.167.92.45		Not listed	AS63737 VIETSERVER-AS-VN	VN	yes

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2023-03-08 21:08:13	http://103.167.92.45/kung/GG18.exe	Offline	exe Loki opendir	abuse_ch

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2023-03-23 23:14:40	8dbcffd97d94be3165aec10026ea0019f4dc271f39791cec1044a4851a7c5db4	exe		Loki
2023-03-23 02:24:36	f4784f17ad8656d1ac9b926def0a4572415f35d83f979f808ea4d4c8024e25cc	exe		Loki
2023-03-22 23:57:46	9b121e2b55d7bd57ebcde6a362a90d941e4d7108be4438f82c1b89aa62f45ef3	exe		Loki
2023-03-22 22:18:06	6c04e613bc5ff2068bfcdab2681bb318fb58bc6d4b0eb3d8263d9465ae46b298	exe		Loki
2023-03-21 02:00:36	9da6da6d54ad5c972dd827ea8a62d7fd76dae32c2c03ef2b0b5d9fd902c7ee34	exe		Loki
2023-03-21 00:27:55	8dd83883d8daee30f21adb85cff72ca768a80559820dd1770399c3f5c86f52ef	exe		Loki
2023-03-13 22:44:59	609be0559c98f1b0cfa4df0dadad1357092385ed03a501e46512b0b583869265	exe		Loki
2023-03-13 04:47:47	b6a3b46a766ba9f0d887a9a0cb0ee17a0219598e31bd71abfa516a407d0b812f	exe		Loki
2023-03-08 21:08:07	6bdb4084f28f803a608a4c7297cbf2ffc188744c16dfe0c6ffc718f00eb497ba	exe		Loki