URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2020-08-13 09:00:08	13.234.238.111	ec2-13-234-238-111.ap-south-1.compute.amazonaws.com	Not listed	AS16509 AMAZON-02	IN	yes

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2020-08-14 11:13:08	http://13.234.238.111/gh/7110328.exe	Offline	AgentTesla exe	abuse_ch
2020-08-14 10:07:04	http://13.234.238.111/gh/220187.exe	Offline	AgentTesla exe	abuse_ch
2020-08-14 06:07:10	http://13.234.238.111/gh/1105677.exe	Offline	AgentTesla exe	abuse_ch
2020-08-13 09:00:08	http://13.234.238.111/gh/157780.exe	Offline	exe Formbook	abuse_ch

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2020-08-14 11:13:08	7b5bc8135bbabcf6428dd19187f5216ef5cbabd88bb8386c91f30b35ac9ae851	exe		AgentTesla
2020-08-14 10:07:04	7224ce18911e8f1865c59ea87da299938b7e1aaa3d1a3bfcc4c5d33bb8ab935d	exe		AgentTesla
2020-08-14 06:07:10	8d022dab121f77e8bc72f928612aa7d06f08f9e0726f509f28a4874f7b4cfe50	exe		AgentTesla
2020-08-13 09:00:08	923909fa41e21d68dbc11443fe31cf99d2792014767e276dd9aa7289a78afa06	exe		Formbook