URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2025-01-02 10:00:07	217.194.133.225		Not listed	AS133199 SONDERCLOUDLIMITED-AS-AP	US	yes

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2025-01-02 10:00:10	http://217.194.133.225:9999/1.exe	Offline	CobaltStrike malware opendir	Joker
2025-01-02 10:00:09	http://217.194.133.225:9999/1.ps1	Offline	Cobalt strike CobaltStrike malware opendir	Joker
2025-01-02 10:00:07	http://217.194.133.225:9999/1.php	Offline	malware opendir webshell	Joker
2025-01-02 10:00:07	http://217.194.133.225:9999/1.asp	Offline	malware opendir webshell	Joker
2025-01-02 10:00:07	http://217.194.133.225:9999/1.soap	Offline	malware opendir webshell	Joker
2025-01-02 10:00:07	http://217.194.133.225:9999/2.php	Offline	malware opendir webshell	Joker
2025-01-02 10:00:07	http://217.194.133.225:9999/1.aspx	Offline	malware opendir webshell	Joker

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2025-01-02 10:00:10	d2f3bf1f985fdd93088380843143d235c55b7188b99d7e728a1c49f8cbeb0a9e	exe		CobaltStrike
2025-01-02 10:00:09	1e5c0566095b5fd64e3d75f7370e99ffc3dd100fd1e5d28087f2f4ab1ceea319	ps1		Cobalt Strike