URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2023-10-13 11:33:07	103.30.11.15		Not listed	AS63737 VIETSERVER-AS-VN	VN	yes

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2023-10-24 07:38:04	http://103.30.11.15/4w4/audiodgse.exe	Offline		JAMESWT_MHT
2023-10-17 11:04:07	http://103.30.11.15/6u6/sihost.exe	Offline	exe Loki opendir	abuse_ch
2023-10-16 07:57:11	http://103.30.11.15/5u5/sihost.exe	Offline	AgentTesla exe	abuse_ch
2023-10-14 03:59:09	http://103.30.11.15/9y9/sihost.exe	Offline	32 AgentTesla exe	zbetcheckin
2023-10-13 11:33:07	http://103.30.11.15/8y8/sihost.exe	Offline	exe Loki opendir	abuse_ch

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2023-10-17 11:04:07	28339d3e1ef5ac3f3efb6d55183c7e67107e64a9c660b2771a407eca09be4a62	exe		Loki
2023-10-16 07:57:11	266e0c476f1988732a361461a4837386b72f215f5135033512c12bb3dde329c6	exe		AgentTesla
2023-10-14 03:59:09	f7b800601e3b238161684a6921827dbed9d3f285740028da7f59e42968fa96cc	exe		AgentTesla
2023-10-13 11:33:07	9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0	exe		Loki