URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2022-01-14 04:36:04	2.58.149.98		Not listed	AS212238 CDNEXT	NL	yes

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2022-01-14 05:32:05	http://2.58.149.98/service21.exe	Offline	32 dcrat exe	zbetcheckin
2022-01-14 05:24:04	http://2.58.149.98/Roblox.exe	Offline	32 exe RedLineStealer	zbetcheckin
2022-01-14 05:23:04	http://2.58.149.98/ss.exe	Offline	32 AsyncRAT exe	zbetcheckin
2022-01-14 05:23:04	http://2.58.149.98/penis.exe	Offline	32 AsyncRAT exe	zbetcheckin
2022-01-14 05:16:04	http://2.58.149.98/8888.exe	Offline	32 AsyncRAT exe	zbetcheckin
2022-01-14 04:36:04	http://2.58.149.98/less.exe	Offline	32 arrowrat exe	zbetcheckin

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2022-01-14 05:32:05	a29951ea9a11c1cdce0ff61bbda1d9e6a8f39477d001d0bfaa4cc67d9d8d0f75	exe		DCRat
2022-01-14 05:24:04	1d13b2332be93f6fbcb4499d1e3ccd075496b4483f610e9b996d0896d4faf435	exe		RedLineStealer
2022-01-14 05:23:04	727a8442fc212991e1f9be99e7cf0bc467ddcd149657ffbdcef8944ba81bc57b	exe		AsyncRAT
2022-01-14 05:23:04	8e816710624f15fee0d69bfff4a809e9a038fd58350e60bc0b798cd0dddb652f	exe		AsyncRAT
2022-01-14 05:16:04	1bf4fa05d7f12a5fccdc00603cd5c730ce0b9ab5c89b05202ee38c0f163c4852	exe		AsyncRAT
2022-01-14 04:36:03	3dbd1065734c9b3e603bc2a81dbadb77beeb54c6a918a6a4ae0687659ac3c0fb	exe		ArrowRAT