URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry


Host: 156.224.79.221
Firstseen:2026-02-22 16:40:06 UTC
Total malware sites :5
Online malware sites :4 (80%)
Offline Malware sites :1 (20%)
Newest active malware site :2026-02-22 16:44:15 UTC
Oldest active malware site :2026-02-22 16:40:24 UTC (Age: 12 hours, 20 minutes)

IP addresses


The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)IP addressHostnameSBLASNCountryActive?
2026-02-22 16:40:24 156.224.79.221Not listedAS61112 AkileCloud- HKyes

Malware URLs


The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)URLStatusTagsReporter
2026-02-22 16:44:15http://156.224.79.221/clientOnlineelf ua-wget NDA0E
2026-02-22 16:42:16http://156.224.79.221/run.shOfflinesh ua-wget NDA0E
2026-02-22 16:40:33http://156.224.79.221/x86Onlineelf mirai ext ua-wget NDA0E
2026-02-22 16:40:33http://156.224.79.221/armv7lOnlineelf mirai ext ua-wget NDA0E
2026-02-22 16:40:24http://156.224.79.221/mipsOnlineelf mirai ext ua-wget NDA0E

The table below shows recent payloads delivery by this host.

Firstseen (UTC)SHA256 hashFile typeBazaarSignature
2026-02-22 16:44:156c99d25b3f5a1f9148009475ff2c944b562bb06339ec0555c05208cbb5dd2445elf 
2026-02-22 16:40:330c46a5d80d77f82b32299d00973094fb5c48ac4f2c408ca452c9837b1e01fed6elfMirai
2026-02-22 16:40:333f708d6260c0cc692ec2fb9a1c646dd268cf252f43d84db872d4b3d723f4ffc7elfMirai
2026-02-22 16:40:24273fa53f3311a6efa02d584d7ce920d4cfffd848dafb075e2df3157ea1d04287elfMirai