URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry


Host: 192.3.146.254
Firstseen:2021-09-08 11:12:03 UTC
Total malware sites :15
Online malware sites :0 (0%)
Offline Malware sites :15 (100%)

IP addresses


The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)IP addressHostnameSBLASNCountryActive?
2021-09-08 11:12:06 192.3.146.254192-3-146-254-host.colocrossing.comNot listedAS36352 AS-COLOCROSSING- USyes

Malware URLs


The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)URLStatusTagsReporter
2021-10-04 09:33:04http://192.3.146.254/rtgs/vbc.exeOfflineexe Formbook ext GuLoader ext opendir abuse_ch
2021-10-04 09:32:06http://192.3.146.254/rtg/vbc.exeOfflineexe Formbook ext GuLoader ext opendir abuse_ch
2021-09-30 15:28:04http://192.3.146.254/xjl/vbc.exeOfflineexe GuLoader ext opendir abuse_ch
2021-09-29 11:05:05http://192.3.146.254/mnc/vbc.exeOffline32 exe zbetcheckin
2021-09-29 09:17:10http://192.3.146.254/xj/vbc.exeOfflineGuLoader ext ps66uk
2021-09-23 20:53:04http://192.3.146.254/mns/vbc.exeOffline32 exe GuLoader ext zbetcheckin
2021-09-23 09:07:05http://192.3.146.254/swi/vbc.exeOffline32 exe Neshta zbetcheckin
2021-09-23 09:07:05http://192.3.146.254/reg/vbc.exeOffline32 exe Formbook ext zbetcheckin
2021-09-23 07:01:03http://192.3.146.254/swis/vbc.exeOfflineexe GuLoader ext opendir abuse_ch
2021-09-17 21:23:05http://192.3.146.254/sim/vbc.exeOffline32 exe Neshta zbetcheckin
2021-09-17 21:09:06http://192.3.146.254/av/vbc.exeOffline32 exe Neshta zbetcheckin
2021-09-17 21:09:05http://192.3.146.254/rim/vbc.exeOffline32 exe Neshta zbetcheckin
2021-09-17 17:43:05http://192.3.146.254/avs/vbc.exeOfflineNeshta remcos ext madjack_red
2021-09-10 05:06:04http://192.3.146.254/glob/vbc.exeOfflineopendir remcos ext RemcosRAT ext AndreGironda
2021-09-08 11:12:06http://192.3.146.254/global/vbc.exeOfflineexe opendir rat RemcosRAT ext abuse_ch

The table below shows recent payloads delivery by this host.

Firstseen (UTC)SHA256 hashFile typeBazaarSignature
2021-10-05 07:37:48e4007053593d910ff36637d471e80b1735eb33be5ef3b92c589be0a5ef6dd874exe  
2021-10-05 07:37:14e4007053593d910ff36637d471e80b1735eb33be5ef3b92c589be0a5ef6dd874exe  
2021-10-04 20:49:261aa3f73f66b556421cee89bd40c06abaf55e0f4bc044d9f4b38c1877ef30b578exe Formbook
2021-10-04 20:48:571aa3f73f66b556421cee89bd40c06abaf55e0f4bc044d9f4b38c1877ef30b578exe Formbook
2021-10-04 09:33:04bb55c88ca46b3d34d58e0fd9eacedc2a4b753f2d6e7d9d1627ba2fd914deac71exeFormbook
2021-10-04 09:32:06bb55c88ca46b3d34d58e0fd9eacedc2a4b753f2d6e7d9d1627ba2fd914deac71exeFormbook
2021-09-30 15:28:04c622d40348e19de1e15a0ff9da40492af2ad5986b099616945d461f8606660efexeGuLoader
2021-09-30 14:51:41c622d40348e19de1e15a0ff9da40492af2ad5986b099616945d461f8606660efexeGuLoader
2021-09-30 07:37:03b4ff488e6f002262f237fb5c6b2bf98e4de8382b381b4cc32af42a4e19b42ee5exeGuLoader
2021-09-29 11:05:056e34dcb9961e3e77b611d86dfd67c5c692e273d9a2d7ff619f9b2004dd918389exe 
2021-09-29 09:17:093dd90bca336828bb4832d955a81ccff768202342522cb480cdd85afbad92d887exeGuLoader
2021-09-23 22:24:17482ebaaeb210fd1a42f240e20edf9c6061fd51a99293ac87c6ce098a0c31ceecexeGuLoader
2021-09-23 20:53:04e7c8915458db610ddac09dd87b544b70a2aaa9f17024ee359ee4a8f39096f3b0exeGuLoader
2021-09-23 09:07:05e51c60f40080414b74c2eeef62780b28aa31c7875dada6dc2097323a61cc8396exeFormbook
2021-09-23 09:07:05ec0627ef1feef5903f5771bdb6df060a295af132e90ed023f2e1ad14d5ffb40bexeNeshta
2021-09-23 08:51:34abc97d710760f9449d691364d7ab0a7c3185f868625b8f05a8ab8facdebe54f1exeGuLoader
2021-09-23 07:01:0393caf6c3cc38aa303bb304b80fb17e202c9420fc05b3a6d2de7da261791fa8f8exeGuLoader
2021-09-17 21:23:0556331fa6c35d48c153e5004cb8574c36e2c16f3bb339e53549dc28ec7ad0f232exeNeshta
2021-09-17 21:09:0656331fa6c35d48c153e5004cb8574c36e2c16f3bb339e53549dc28ec7ad0f232exeNeshta
2021-09-17 21:09:0556331fa6c35d48c153e5004cb8574c36e2c16f3bb339e53549dc28ec7ad0f232exeNeshta
2021-09-17 17:43:0556331fa6c35d48c153e5004cb8574c36e2c16f3bb339e53549dc28ec7ad0f232exeNeshta
2021-09-10 05:06:04b67741cbd39464c7526c9cda83175c342aaba91fb990dd96d60083d028f00228exeRemcosRAT
2021-09-09 08:05:49dc78ddc35f00b7de6dcf9da70b907879de51d2188f7a418acd57fa95352ce724exeRemcosRAT
2021-09-08 11:12:06fb687141c9dff2926002ee0e5a4473e37e771fe210caf292aeff920d15439528exeRemcosRAT