URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2023-11-09 07:07:10	103.29.3.200		Not listed	AS140815 HTTVSERVER-VN	VN	yes

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2023-11-28 07:16:14	http://103.29.3.200/M2711T/wininit.exe	Offline	AgentTesla exe njRAT	abuse_ch
2023-11-27 10:41:08	http://103.29.3.200/S2611M/wininit.exe	Offline	exe Formbook opendir	abuse_ch
2023-11-13 17:09:09	http://103.29.3.200/S1211M/wininit.exe	Offline	exe Formbook opendir	abuse_ch
2023-11-09 07:07:10	http://103.29.3.200/W0811T/wininit.exe	Offline	exe Formbook opendir	abuse_ch

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2023-11-28 07:16:14	25230f90c2a568247464b943d281c7bf9df13fb2e3b5c3b4eefa46d5d3c618f5	exe		njrat
2023-11-27 10:41:08	685107cecf3e5ac7ad43e40a9fc7d8ea35179a40973938ff74e5813d0a61dffc	exe		Formbook
2023-11-22 19:03:33	0b03f2b638d4d53380ac36eb81447fb22ec1440cb6b91e7eabb51bee6604fe3e	exe
2023-11-13 17:09:09	29b83b860f2b115aaceaf7e5a5532c24d736392e34a5eaef229f39a0ba7bb983	exe		Formbook
2023-11-09 16:16:31	925fa037b496ed141df2f58ee1eddac36a26a9ec3bf6888c7e4066764fa0f51c	exe		Formbook
2023-11-09 07:07:09	f26ef2dc3870b6ee2f05973fcd97b1e55f817524eac8bdbe6863e584c6cf2821	exe		Formbook