URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2020-04-07 17:47:07	222.73.173.200		Not listed	AS4812 CHINANET-SH-AP	CN	yes

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2020-04-07 17:50:05	http://222.73.173.200:8080/system.exe	Offline	ddos exe nitol	0xrb
2020-04-07 17:49:04	http://222.73.173.200:8080/systom.exe	Offline	ddos exe	0xrb
2020-04-07 17:48:19	http://222.73.173.200:8080/quan	Offline	elf	0xrb
2020-04-07 17:48:12	http://222.73.173.200:8080/m	Offline	elf	0xrb
2020-04-07 17:48:06	http://222.73.173.200:8080/a6	Offline	elf	0xrb
2020-04-07 17:47:07	http://222.73.173.200:8080/a4	Offline	elf	0xrb

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2020-04-07 17:50:05	dc7fcd7095efb98b2733651c4193157bf84b69fa317770b2855053d3c4c424a0	exe		Nitol
2020-04-07 17:49:04	5ac2874a009b3042a6673e18c5ea417bfc9b6155beb25a86d87aa77e3e7b2d0d	exe
2020-04-07 17:48:19	8c1cf463b5a098c9670f4df4e1c74d255e6e45bb83e3789a6875bbaf1b17c397	elf
2020-04-07 17:48:12	f69cf41364e3872921250f85275e66aa2665a31821b27e63ff1064cedaac378a	elf
2020-04-07 17:48:06	8589c74404cfcaa64ec129a6bc58fce1a0cf53ecd0410a959eff3c11fc9fecf5	elf
2020-04-07 17:47:05	7771a54ce9653101523b5036b1e4bb31ccfb1dc52dcab67209d0b728861fa5be	elf