🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry


Host: 154.216.20.76
Firstseen:2024-08-27 08:13:03 UTC
Total malware sites :21
Online malware sites :0 (0%)
Offline Malware sites :21 (100%)

IP addresses


The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)IP addressHostnameSBLASNCountryActive?
2024-08-27 08:13:08 154.216.20.76Not listedAS11404 AS-WAVE-1- USyes

Malware URLs


The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)URLStatusTagsReporter
2024-09-26 17:24:40http://154.216.20.76/cpu/nanominer-linux-3.7.7....OfflineCoinMiner gz NanoMiner opendir NDA0E
2024-09-26 17:21:17http://154.216.20.76/lan.jpgOfflinegz ladvix opendir NDA0E
2024-09-26 17:21:15http://154.216.20.76/lan/jbruteOfflineelf ladvix opendir NDA0E
2024-09-26 17:21:14http://154.216.20.76/jbruteOfflineelf ladvix opendir NDA0E
2024-09-26 17:21:08http://154.216.20.76/test.jpgOfflinegz ladvix opendir NDA0E
2024-09-26 17:21:07http://154.216.20.76/i.fakeOfflinegz opendir NDA0E
2024-09-26 17:21:07http://154.216.20.76/dr.jpgOfflineCVE-2016-5195 DirtyCow gz opendir NDA0E
2024-09-26 17:21:07http://154.216.20.76/lan/startOfflinebruteforce opendir sh NDA0E
2024-09-26 17:21:06http://154.216.20.76/.c/loginclientbotOfflineelf ladvix opendir NDA0E
2024-09-26 17:21:05http://154.216.20.76/lan/ps2Offlineelf ladvix opendir NDA0E
2024-09-26 17:21:05http://154.216.20.76/iptablesOfflineopendir sh NDA0E
2024-09-26 17:21:05http://154.216.20.76/installOfflineopendir sh NDA0E
2024-09-26 17:21:05http://154.216.20.76/lastOfflineopendir sh NDA0E
2024-09-26 17:21:05http://154.216.20.76/migOfflineCleanlog elf hacktool ladvix LogWiper opendir NDA0E
2024-09-26 17:21:05http://154.216.20.76/juiceseif.jpgOfflinegz opendir rootkit NDA0E
2024-09-26 17:21:05http://154.216.20.76/2023Offlineelf ladvix opendir NDA0E
2024-09-26 17:20:13http://154.216.20.76/cpu.jpgOfflineCoinMiner gz opendir NDA0E
2024-09-26 17:19:25http://154.216.20.76/dev.jpgOfflineCoinMiner gz opendir NDA0E
2024-09-26 17:19:06http://154.216.20.76/cpu/cpu.shOfflineCoinMiner opendir sh NDA0E
2024-08-27 08:14:05http://154.216.20.76/nnn.exeOfflineexe njRAT ext opendir xworm NDA0E

The table below shows recent payloads delivery by this host.

Firstseen (UTC)SHA256 hashFile typeBazaarSignature
2024-09-26 17:24:4063a2718ded8acb0679e30d6115c2414051cfb7378054672a2cd202b976dc2a30unknown  
2024-09-26 17:21:17a733d96ca9df1994830f42f7914f6ef45f31788754ff3e47c68106c58fc0e46cunknown  
2024-09-26 17:21:1546e3ac57df591e63bca101be558d49f8a90ebfa0bd39ee516c143711bb74549belf  
2024-09-26 17:21:1496273e46a800bb8a08195365f8b249215834c07fdce90c0f2571ef8b569ed488elf  
2024-09-26 17:21:08456390dbd27ccb743a52d7d725a45ee476f8166f2a21b8bc333e96dd276eff64unknown  
2024-09-26 17:21:0727fa66980fa184a95f9f7c40c874568f339db5229b8a98b2aa9a3202e0a403fcunknown  
2024-09-26 17:21:07c433453f93bb28661d0befecfb472cf5a43c6a4be80e7357781a0c1c6c0590daunknown  
2024-09-26 17:21:075b140d70379e8107a3482a3bda6cb1c93efe13161761d4b63333cadd866b2553sh  
2024-09-26 17:21:067a7a342afaccaf81565a501c0ea928a1c17e4121763e5bb28183e9e264e81198elf  
2024-09-26 17:21:055829c6029d67cd266ece7ddb52c4fbd581f7ee469d71d7dc4948cedc2956ab23sh  
2024-09-26 17:21:051c14e5b1ff2be0f66dcecfa51ab1db3f5cec5959e16d8f919a9a9d5804c9c089elf  
2024-09-26 17:21:0599618a7eb9660d493685a14d752f597e8fb303f12a6bbc9bb52c87f02e55f07ash  
2024-09-26 17:21:0526cc4d4d6fae20cb0e62550e2e04d45cedef40cc7d15a829fe83964c19e045desh  
2024-09-26 17:21:0558dbe59f3c201218bc77c2757f4ba66334c8657464dc06ae61354460499722e5elf 
2024-09-26 17:21:053f37f1c383dcf32de86f91de1daef3d9a9d630b0ea5e9ee87367d87703426d63unknown  
2024-09-26 17:21:052435928486ca968ac345ebd544d010d8e9e1b792db6801d0f65c14ecafdd153eelf  
2024-09-26 17:20:137e6e508f7ffc277061c1588a318c66c999015991c866a6941924c1f0a34c58f5unknown  
2024-09-26 17:20:0691a86de01b0a646e6c56d84a070e7ebd4f7d19c81ec56250a3d2ecb94a8470a2elf 
2024-09-26 17:19:25c14e71b86173f5fa0f4b487931f8b6651ff8ffc1dd3a7f0908d17adfbee7169eunknown  
2024-09-26 17:19:0612fc85805f55b4944664730a5ba9cfe109471ad12d01dfbdbe2de8244e8b5cf6sh  
2024-08-27 08:14:05db959d1bd5d9ce56cbfc7f19d375e8f29941a926a2e5fd543653e63420cc7794exe njrat