URLhaus Database
Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).
Database Entry
| Host: | 1h.xeteloi4.ru |
|---|---|
| Domain registrar: | n/a |
| Domain registration date: | 2025-08-21 19:08:56 UTC |
| Spamhaus DBL : | Abused domain (malware) |
| SURBL : | Blocked |
| Quad9 : | Blocked |
| AdGuard : | Blocked |
| Cloudflare : | Blocked |
| ProtonDNS : | Blocked |
| OpenBLD : | Blocked |
| DNS4EU : | Not blocked |
| Control D HaGeZi : | Not blocked |
| Firstseen: | 2025-08-26 19:06:04 UTC |
| Total malware sites : | 1 |
| A record(s) observed : | 12 |
IP addresses
The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.
| Firstseen (UTC) | IP address | Hostname | SBL | ASN | Country | Active? |
|---|---|---|---|---|---|---|
| 2026-08-22 11:24:25 | 172.236.104.157 | k8s-svc-lander-openprovider-expired-us-ord-02.parklogic.net | Not listed | AS63949 AKAMAI-LINODE-AP |  US | yes |
| 2026-08-22 11:24:25 | 172.236.104.43 | k8s-svc-lander-openprovider-expired-us-ord-01.parklogic.net | Not listed | AS63949 AKAMAI-LINODE-AP | US | yes |
| 2026-08-22 11:24:25 | 172.238.172.122 | k8s-svc-lander-openprovider-expired-us-ord-03.parklogic.net | Not listed | AS63949 AKAMAI-LINODE-AP | US | yes |
| 2025-08-26 19:06:09 | 188.114.96.3 | Not listed | AS13335 CLOUDFLARENET | n/a | no | |
| 2025-08-26 19:06:09 | 188.114.97.3 | Not listed | AS13335 CLOUDFLARENET | n/a | no | |
| 2026-06-05 08:48:15 | 188.114.96.12 | SBL687667 | AS13335 CLOUDFLARENET | n/a | no | |
| 2026-06-05 08:48:15 | 188.114.97.12 | Not listed | AS13335 CLOUDFLARENET | n/a | no | |
| 2025-09-13 21:07:54 | 104.21.16.127 | Not listed | AS13335 CLOUDFLARENET | n/a | no | |
| 2025-09-13 21:07:54 | 172.67.212.180 | Not listed | AS13335 CLOUDFLARENET | n/a | no | |
| 2026-08-25 17:29:57 | 172.232.29.171 | k8s-svc-lander-openprovider-owned-us-ord-02.parklogic.net | Not listed | AS63949 AKAMAI-LINODE-AP | US | no |
Malware URLs
The table below shows all malware URLs that are associated with this particular host.
| Dateadded (UTC) | URL | Status | Tags | Reporter |
|---|---|---|---|---|
| 2025-08-26 19:06:09 | https://1h.xeteloi4.ru/vywerrzo27.hta | Online | ClearFake | Anonymous |
The table below shows recent payloads delivery by this host.
| Firstseen (UTC) | SHA256 hash | File type | Bazaar | Signature |
|---|---|---|---|---|
| 2026-08-26 20:15:53 | 65a0e136d90bf00d916db98a03f11f804be97a286ecf84a5694699b3cbfaf7e1 | hta | ||
| 2026-08-26 15:26:00 | 6c066696467899a1189645f806249f2cb3e21b7a3f525af6f37aa9db4d93e330 | hta | ||
| 2026-08-26 09:50:57 | 2dd9e10629fa2d5cadd1414b878f33cfb7d6e1d5278b4506f13b4c8dafcd0aea | hta | ||
| 2026-08-26 07:54:28 | 6c3e7b3e2ec1f0448301f0309946459d0e10eaa021231c730a383bc3b67f4604 | hta | ||
| 2026-08-26 02:54:51 | ba02e4117514e7d69bb19c9f96c01d5b69b530a9bbdd93be45b97d4a9f502be8 | hta | ||
| 2026-08-25 21:05:55 | 0e47825b38a8b078af16722ff4f49e6988cd2dd1e1faf8062934e3970d13f5eb | hta | ||
| 2026-08-25 17:29:56 | be8a1f5da191fe2c57642e9b1057c6b2dfe581bf6f8be2f01d942274849a064b | hta | ||
| 2026-08-25 14:24:30 | 1af476c59ae9c2b729bc399900524d6a906ff7578dbdc736f642305bdebc6a03 | hta | ||
| 2025-08-26 19:06:09 | 6d0d77e639d5062d7fc34b0ef354ea25fee4e1c9fc31502841f08b5342c31632 | unknown |