URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2023-12-06 13:49:06	185.221.198.96		Not listed	AS9009 M247	DE	yes

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2023-12-12 03:45:10	http://185.221.198.96/Master_data.exe	Offline	32 exe LummaStealer	zbetcheckin
2023-12-11 20:38:05	http://185.221.198.96/traffico.exe	Offline	32 exe RedLineStealer	zbetcheckin
2023-12-11 16:41:05	http://185.221.198.96/olehps.exe	Offline	32 exe RedLineStealer	zbetcheckin
2023-12-07 04:07:06	http://185.221.198.96/deluxe_crypted.exe	Offline	32 exe LummaStealer	zbetcheckin
2023-12-06 13:49:06	http://185.221.198.96/red.exe	Offline	32 exe LummaStealer	zbetcheckin

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2023-12-12 03:45:10	c1df654f9452c3768237bd3898122934ee6bf1c12157ab112917225c9903d466	exe		LummaStealer
2023-12-11 20:38:05	320d7be57b8e56249ba0892fc78bdf7fbae8d54fc8709bc86c7cf98f56189f0e	exe		RedLineStealer
2023-12-11 16:41:05	d58937d468f6ca92b12ee903a16a4908de340f64f894cf7f1c594cd15c0c7e47	exe		RedLineStealer
2023-12-07 04:07:06	a49b3483e2f2bd0049198e2738acc62b8326f4b86d09a55b12b94f0bb4505f66	exe		LummaStealer
2023-12-06 13:49:06	4e70f9de2a4e122b0ba1db7c63ac443e39bbfd9e2b475e8fb29d12ad964bfd7e	exe		LummaStealer