URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2020-07-01 08:36:06	198.144.176.137	198-144-176-137-host.colocrossing.com	Not listed	AS36352 AS-COLOCROSSING	US	yes

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2020-07-01 10:09:14	http://198.144.176.137/new.exe	Offline	exe NanoCore	zbetcheckin
2020-07-01 10:08:04	http://198.144.176.137/file.exe	Offline	exe NanoCore	zbetcheckin
2020-07-01 08:36:06	http://198.144.176.137/loki.exe	Offline	exe Loki NanoCore	oppimaniac

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2020-07-06 21:23:17	961b36bb78d27b3432fae08e5c4272fe295b5e24e832c6f6bf1ec3cf87057dab	exe
2020-07-05 23:16:12	49734ef67be2f2a71545820ed6258683d03a9aa3a97db586aea7d148090b4fa4	exe		NanoCore
2020-07-05 22:55:13	3fe2d0dd224e7799ad1d669d3e01ec1676ce6ba39170e12df1a600ca49ae3422	exe		Loki
2020-07-02 11:10:17	cf2ae6336471a78f6df77e11aaf70256bbdf16c64392c615e1ab2b3fbacce71a	exe		NanoCore
2020-07-02 11:10:17	cf2ae6336471a78f6df77e11aaf70256bbdf16c64392c615e1ab2b3fbacce71a	exe		NanoCore
2020-07-01 10:09:14	3dc9838107abe50dfcd90972d2e1a5a8e2aa6e735723fa635927bd4ddb790e81	exe		NanoCore
2020-07-01 10:08:04	5c3d4d39b3420ad107704cfc09635b54777bb36b15fb9215d4aa736a55a0cbd0	exe		NanoCore
2020-07-01 08:36:04	5c3d4d39b3420ad107704cfc09635b54777bb36b15fb9215d4aa736a55a0cbd0	exe		NanoCore