URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

Host:	130.94.3.67
Firstseen:	2026-10-21 05:34:05 UTC
Total malware sites :	4
Online malware sites :	0 (0%)
Offline Malware sites :	4 (100%)

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2026-10-21 05:34:13	130.94.3.67		Not listed	AS154177 LIGHT4-AS-AP	VN	yes

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2026-10-21 05:34:28	http://130.94.3.67:8099/harvest234.ps1	Offline	credential-harvester post-exploitation ps1	z3r0s6
2026-10-21 05:34:14	http://130.94.3.67:8099/sysharvest.ps1	Offline	credential-harvester post-exploitation ps1	z3r0s6
2026-10-21 05:34:13	http://130.94.3.67:8099/harvest237.ps1	Offline	credential-harvester post-exploitation ps1	z3r0s6
2026-10-21 05:34:13	http://130.94.3.67:8099/relay_child.ps1	Offline	post-exploitation ps1 reverse-tunnel	z3r0s6

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type
2026-10-21 05:34:27	7ddf1eaaafcd3d09fd3909225a461af03488afceb540d7dbd21f95b1ddfed176	txt
2026-10-21 05:34:11	9ce27aa1ec34d8d1564d25a455244eea492df6d015ff72fa9c01ba06a774f7b7	txt
2026-10-21 05:34:11	e28d797178685f16156ec86559829858de101550f45a6d3df75c3d60f010afa5	txt
2026-10-21 05:34:10	fe1205c69bfdbf401bbda8865eb1be1f7d7482143f0ec99baa1e5b0270dde000	txt