URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

Host: 185.222.57.80
Firstseen:2023-02-26 14:50:51 UTC
Total malware sites :4
Online malware sites :0 (0%)
Offline Malware sites :4 (100%)

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)IP addressHostnameSBLASNCountryActive?
2023-02-16 14:09:10 185.222.57.80hosted-by.rootlayer.netNot listedAS51447 ROOTLAYERNET- NLyes

Malware URLs

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)URLStatusTagsReporter
2023-02-16 14:10:07http://185.222.57.80/7900/vbc.exeOfflineAgentTesla ext exe abuse_ch
2023-02-16 14:10:06http://185.222.57.80/O_O.DOCOfflineAgentTesla ext abuse_ch
2023-02-16 14:09:10http://185.222.57.80/OO.DOCOffline abuse_ch
2023-02-16 14:09:10http://185.222.57.80/2545/vbc.exeOfflineexe opendir abuse_ch

The table below shows recent payloads delivery by this host.

Firstseen (UTC)SHA256 hashFile typeBazaarSignature
2023-02-17 09:31:21ca69b2a10374843efe51585a58ffa43f65fd4cb0f78787009d94eeac637db8b1exeAgentTesla
2023-02-16 14:10:07f2d2638afb528c7476c9ee8e83ddb20e686b0b05f53f2f966fd9eb962427f8aaexe 
2023-02-16 14:10:063eb5a92bacab0fe5c84e9e519deed2585124bdb255a6b687ca47cdeffd566a59rtfAgentTesla
2023-02-16 14:09:0406f3e15ad205552afc6b51b29992eae57f14a15f813314e330b1885c8e04f321rtf 
2023-02-16 14:09:04f2d2638afb528c7476c9ee8e83ddb20e686b0b05f53f2f966fd9eb962427f8aaexe