URLhaus Database
Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).
Database Entry
| Host: | 104.168.45.23 |
|---|---|
| Firstseen: | 2024-04-30 05:51:04 UTC |
| Total malware sites : | 3 |
| Online malware sites : | 0 (0%) |
| Offline Malware sites : | 3 (100%) |
IP addresses
The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.
| Firstseen (UTC) | IP address | Hostname | SBL | ASN | Country | Active? |
|---|---|---|---|---|---|---|
| 2024-04-30 05:51:07 | 104.168.45.23 | 104-168-45-23-host.colocrossing.com | Not listed | AS36352 AS-COLOCROSSING |  US | yes |
Malware URLs
The table below shows all malware URLs that are associated with this particular host.
| Dateadded (UTC) | URL | Status | Tags | Reporter |
|---|---|---|---|---|
| 2024-04-30 05:51:10 | http://104.168.45.23/9090/jhn/iwanttokiswithlot... | Offline | AgentTesla  doc |  abuse_ch |
| 2024-04-30 05:51:09 | http://104.168.45.23/9090/NEWST.txt | Offline | AgentTesla ascii Encoded Formbook | abuse_ch |
| 2024-04-30 05:51:07 | http://104.168.45.23/9090/imageveryclearfisherm... | Offline | AgentTesla ascii vbs | abuse_ch |
The table below shows recent payloads delivery by this host.
| Firstseen (UTC) | SHA256 hash | File type | Bazaar | Signature |
|---|---|---|---|---|
| 2024-04-30 05:51:09 | 1d9605f0dfc717da8d65b22675530d8a3ed3c7160734981b8f87e9c4eade0489 | txt | Formbook | |
| 2024-04-30 05:51:07 | 7efd84f97479f088a505010d2618b54ee21184d847b17a2530b0c0a65f023908 | unknown | ||
| 2024-04-30 05:51:06 | 80de1acac6b8b5a9426cbe1d11f864fe1da9bd2a66b1eebfdf8eca91f227b612 | rtf | AgentTesla |