URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2021-10-13 15:00:08	192.3.222.155	192-3-222-155-host.colocrossing.com	Not listed	AS36352 AS-COLOCROSSING	US	yes

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2021-10-21 08:28:08	http://192.3.222.155/008/vbc.exe	Offline	exe Formboo Formbook opendir	abuse_ch
2021-10-19 08:51:06	http://192.3.222.155/00660066/vbc.exe	Offline	exe Formbook Neshta opendir	abuse_ch
2021-10-14 11:05:07	http://192.3.222.155/0050000/vbc.exe	Offline	exe Formbook opendir	abuse_ch
2021-10-13 15:00:08	http://192.3.222.155/008008/vbc.exe	Offline	exe Formbook opendir	abuse_ch

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2021-10-21 08:28:08	602b818b816dd421212e56f00c0f6ac807e1f01497601fcd49e1e081b8fdcb24	exe		Formbook
2021-10-20 09:17:49	5f3c6cd7f6d54960aed892858ce0d249018bf03b3b6acbb7d6de735ee419dc48	exe		Neshta
2021-10-19 08:51:06	1e5bb5e00fddfcc62c8bfe71b46a4c8c6c22986c7a51931d16b8ddc465170d72	exe		Formbook
2021-10-14 11:05:07	3490cb5fd9a372722f95ed69c41e23d5cd274ce6b3c024ec1731962a380409d6	exe		Formbook
2021-10-13 15:00:07	298d542746dfa4922dd5fbc8fab572be58447c9dbd1481c55bd2254bb275684f	exe		Formbook