URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2020-12-14 19:00:05	18.197.62.51	ec2-18-197-62-51.eu-central-1.compute.amazonaws.com	Not listed	AS16509 AMAZON-02	DE	yes

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2020-12-14 19:01:06	http://18.197.62.51/hkcmd/bin2.exe	Offline	exe Formbook opendir	abuse_ch
2020-12-14 19:01:05	http://18.197.62.51/hkcmd/binl.exe	Offline	exe Formbook opendir	abuse_ch
2020-12-14 19:01:05	http://18.197.62.51/hkcmd/bin88.exe	Offline	exe Formbook opendir	abuse_ch
2020-12-14 19:00:05	http://18.197.62.51/hkcmd/bin.exe	Offline	exe Formbook opendir	abuse_ch

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2020-12-15 05:46:24	319795a056019b583b556b445052ec4c33446a75b7310af85bf15be00b2cf94e	exe		Formbook
2020-12-15 04:06:51	90f2c4a6ef44f74b478893cdd505c759dbe924f984daf87726ba7e64edd091c4	exe		Formbook
2020-12-14 22:18:59	46a62d0c493c466428aacdd8d980868e7065e12a33216983b7efea8e013fe37e	exe		Formbook
2020-12-14 19:01:06	97b414e4df32b2618618bf61922085e35879a743b6cae758f73747682bdc7b02	exe		Formbook
2020-12-14 19:01:05	bbe42dcd5a1d942b3267093fba6232d48183c82500a67e03905864bcbe68b609	exe		Formbook
2020-12-14 19:01:05	3571d3ca49f3c593d4b34f2d7bd9aa8ab2b0bfb99111a2a2561a0d25d494fa2f	exe		Formbook
2020-12-14 19:00:05	8daa411eb30ad00d9be98b72d66343cd681616040c1b825a4b35bfc2a27ee1de	exe		Formbook