URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2020-07-13 09:55:09	198.23.213.30	198-23-213-30-host.colocrossing.com	Not listed	AS36352 AS-COLOCROSSING	US	yes

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2020-08-19 22:21:34	http://198.23.213.30/wordart.doc	Offline	RTF	zbetcheckin
2020-08-19 22:21:32	http://198.23.213.30/wm.exe	Offline	exe njRAT	zbetcheckin
2020-08-19 22:10:45	http://198.23.213.30/wg.exe	Offline	AgentTesla exe	zbetcheckin
2020-08-19 22:10:42	http://198.23.213.30/wixx.exe	Offline	exe NetWire	zbetcheckin
2020-08-19 22:09:54	http://198.23.213.30/wix.exe	Offline	exe njRAT	zbetcheckin
2020-08-19 11:08:05	http://198.23.213.30/ngx.exe	Offline	AgentTesla exe	abuse_ch
2020-07-22 05:20:40	http://198.23.213.30/word.exe	Offline	AgentTesla exe njRAT	abuse_ch
2020-07-17 11:32:03	http://198.23.213.30/wii.exe	Offline	njRAT	JAMESWT_MHT
2020-07-17 11:12:03	http://198.23.213.30/wordx.doc	Offline	njRAT	JAMESWT_MHT
2020-07-13 09:55:12	http://198.23.213.30/wxx.exe	Offline	njRat exe njRAT	0x3c7
2020-07-13 09:55:09	http://198.23.213.30/word.doc	Offline	njRAT RTF	0x3c7

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2020-08-19 22:21:34	915d3671b676c842be045ce0a988511fd5740acb1f6448ebc388dcef92184fe1	rtf
2020-08-19 22:21:32	d949ea4466b8a6048f1e1ba10f5720e5c03b6cf4b1e31a818900686f46e63e8e	exe		njrat
2020-08-19 22:10:45	590cea1db2f4c767f7e75c0eb19be8a212414328cfb43f7be01cc05f807af69e	exe		AgentTesla
2020-08-19 22:10:42	0892b7b2ad0aac4629713617e299fd32923756730c015e60a9442b3b2e053179	exe		NetWire
2020-08-19 22:09:54	bc1b24f6369fa108b03132e92ae1da9f14aa007c3dfb665cdf47a0282fefecf5	exe		njrat
2020-08-19 11:08:05	095844e6eef92d5fa2ad30b887878b2874255453b4706285a7633edbb9216119	exe		AgentTesla
2020-08-06 03:01:08	cebee7dc0112f960319868d6df1f9db37868e1912def20304af20a21bf409250	exe		njrat
2020-08-01 01:25:18	f226b44eb44a2b8883a1966be5a943ed2ecf6646a094b6cccb78f23d08796e7e	exe		njrat
2020-07-24 09:54:26	fa7942a25cea90d890bca23298576191b75723375e2106d8ada228a85bfcfa7f	exe		njrat
2020-07-24 09:31:20	891a8e460bcb5674dcb63bb4822e7fe2b44c5e3bce54eef8138f1359b810c216	exe
2020-07-23 06:52:23	4915f66ed7caab4de6137ad5a73319f0e6bd04303545b57aa0f73bd224acedd9	exe		AgentTesla
2020-07-22 18:09:12	b7e01380d58027103b282b33a910791af457a82a584b1f4aef4cbabb5bac62bc	exe		njrat
2020-07-22 05:20:40	476d02f7c777bb08d97cf87c305e3cb4f41501c1b15ddd88e55f31bff0767b0a	exe		njrat
2020-07-20 04:15:05	85830e6bdfb6889df4ee9fb075c9532e08f85a192c2272c79e9a0d869e267334	exe		njrat
2020-07-17 11:32:03	39278bb543a44e69036e92d227d7af7a51807be8fc476157c50510c569a11121	exe		njrat
2020-07-17 11:12:03	5e0c9ae3d220d6e59d934fdc7cfae2ab70c2a1dc268d5beaf9c041ab5f3973df	rtf		njrat
2020-07-17 05:03:20	4264a2c707b26ff550984c32f308310627e09ae6240a0896a3d1be3e361dd84f	exe		njrat
2020-07-13 09:55:12	596acc8d26bffcc1fe284217efb333e2c20b5c8767676c5d998c6787ecdf3fcf	exe		njrat
2020-07-13 09:55:09	f9ddc04378f1933a94f82a3292731d65025f9956742bc3292157f9735823ef7f	rtf