URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry


Host: 196.189.130.28
Firstseen:2024-11-11 10:05:05 UTC
Total malware sites :27
Online malware sites :0 (0%)
Offline Malware sites :27 (100%)

IP addresses


The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)IP addressHostnameSBLASNCountryActive?
2024-11-11 10:05:11 196.189.130.28Not listedAS24757 EthioNet-AS- ETyes

Malware URLs


The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)URLStatusTagsReporter
2026-08-19 10:01:31http://196.189.130.28:43450/iOfflinemirai ext cesnet_certs
2026-08-14 00:32:19http://196.189.130.28:46269/bin.shOffline32-bit arm elf mirai ext Mozi ext geenensp
2026-08-13 10:01:51http://196.189.130.28:46269/iOfflinemirai ext cesnet_certs
2025-02-28 05:27:04http://196.189.130.28:48891/bin.shOffline32-bit arm elf mirai ext Mozi ext geenensp
2025-02-06 06:04:05http://196.189.130.28:54606/Mozi.mOfflinemirai ext Mozi ext Gandylyan1
2025-01-30 02:15:04http://196.189.130.28:47078/iOffline32-bit arm elf mirai ext Mozi ext geenensp
2025-01-30 01:53:03http://196.189.130.28:47078/bin.shOffline32-bit arm elf mirai ext Mozi ext geenensp
2025-01-26 14:49:04http://196.189.130.28:49536/Mozi.mOfflineelf mirai ext Mozi ext lrz_urlhaus
2024-12-30 23:45:08http://196.189.130.28:50737/iOffline32-bit arm elf mirai ext Mozi ext geenensp
2024-12-30 23:17:06http://196.189.130.28:50737/bin.shOffline32-bit arm elf mirai ext Mozi ext geenensp
2024-12-21 10:03:05http://196.189.130.28:33664/iOffline32-bit arm elf mirai ext Mozi ext geenensp
2024-12-21 09:42:06http://196.189.130.28:33664/bin.shOffline32-bit arm elf mirai ext Mozi ext geenensp
2024-12-19 19:04:06http://196.189.130.28:33664/Mozi.mOfflineelf mirai ext Mozi ext lrz_urlhaus
2024-12-17 16:51:06http://196.189.130.28:53417/Mozi.mOfflineelf mirai ext Mozi ext lrz_urlhaus
2024-12-09 01:53:05http://196.189.130.28:33760/iOffline32-bit arm elf mirai ext Mozi ext geenensp
2024-12-09 01:10:15http://196.189.130.28:33760/bin.shOffline32-bit arm elf mirai ext Mozi ext geenensp
2024-12-08 19:04:06http://196.189.130.28:33760/Mozi.mOfflineelf mirai ext Mozi ext lrz_urlhaus
2024-12-06 14:04:06http://196.189.130.28:57407/Mozi.mOfflineelf mirai ext Mozi ext lrz_urlhaus
2024-12-06 13:23:07http://196.189.130.28:57407/iOffline32-bit arm elf mirai ext Mozi ext geenensp
2024-12-06 03:19:07http://196.189.130.28:57407/bin.shOffline32-bit arm elf mirai ext Mozi ext geenensp
2024-11-26 04:35:08http://196.189.130.28:50968/iOffline32-bit arm elf mirai ext Mozi ext geenensp
2024-11-26 02:41:05http://196.189.130.28:50968/bin.shOffline32-bit arm elf mirai ext Mozi ext geenensp
2024-11-25 23:35:07http://196.189.130.28:50968/Mozi.mOfflineelf mirai ext Mozi ext lrz_urlhaus
2024-11-22 10:27:06http://196.189.130.28:49027/iOffline32-bit arm elf mirai ext Mozi ext geenensp
2024-11-22 09:38:06http://196.189.130.28:49027/bin.shOffline32-bit arm elf mirai ext Mozi ext geenensp
2024-11-11 20:29:05http://196.189.130.28:54636/bin.shOffline32-bit arm elf mirai ext Mozi ext geenensp
2024-11-11 10:05:11http://196.189.130.28:54636/iOffline32-bit arm elf mirai ext Mozi ext geenensp

The table below shows recent payloads delivery by this host.

Firstseen (UTC)SHA256 hashFile typeBazaarSignature
2026-08-19 10:01:3012013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0efelfMirai
2026-08-14 00:32:1912013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0efelfMirai
2026-08-13 10:01:5112013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0efelfMirai
2025-02-28 05:27:0412013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0efelfMirai
2025-02-06 06:04:0512013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0efelfMirai
2025-01-30 02:15:0412013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0efelfMirai
2025-01-30 01:53:0312013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0efelfMirai
2025-01-26 14:49:0412013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0efelfMirai
2024-12-30 23:45:0812013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0efelfMirai
2024-12-30 23:17:0612013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0efelfMirai
2024-12-21 10:03:0512013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0efelfMirai
2024-12-21 09:42:0612013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0efelfMirai
2024-12-19 19:04:0612013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0efelfMirai
2024-12-17 16:51:0612013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0efelfMirai
2024-12-09 01:53:0512013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0efelfMirai
2024-12-09 01:10:1512013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0efelfMirai
2024-12-08 19:04:0612013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0efelfMirai
2024-12-06 14:04:0612013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0efelfMirai
2024-12-06 13:23:0712013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0efelfMirai
2024-12-06 03:19:0712013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0efelfMirai
2024-11-26 04:35:0812013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0efelfMirai
2024-11-26 02:41:0512013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0efelfMirai
2024-11-25 23:35:0712013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0efelfMirai
2024-11-22 10:27:0612013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0efelfMirai
2024-11-22 09:38:0612013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0efelfMirai
2024-11-11 20:29:0512013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0efelfMirai
2024-11-11 10:05:0612013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0efelfMirai