URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry


Host: 23.94.66.68
Firstseen:2024-07-07 19:11:05 UTC
Total malware sites :5
Online malware sites :0 (0%)
Offline Malware sites :5 (100%)

IP addresses


The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)IP addressHostnameSBLASNCountryActive?
2024-07-07 19:11:32 23.94.66.6823-94-66-68-host.colocrossing.comNot listedAS36352 AS-COLOCROSSING- USyes

Malware URLs


The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)URLStatusTagsReporter
2024-07-08 07:12:12http://23.94.66.68:8888/supershell/compile/down...Offlinesupershell-c2 RacWatchin8872
2024-07-07 19:11:37http://23.94.66.68:8888/supershell/compile/down...Offlinesupershell-c2 RacWatchin8872
2024-07-07 19:11:32http://23.94.66.68:8888/supershell/compile/down...Offlinesupershell-c2 RacWatchin8872
2024-07-07 19:11:32http://23.94.66.68:8888/supershell/compile/down...Offlinesupershell-c2 RacWatchin8872
2024-07-07 19:11:32http://23.94.66.68:8888/supershell/compile/down...Offlinesupershell-c2 RacWatchin8872

The table below shows recent payloads delivery by this host.

Firstseen (UTC)SHA256 hashFile typeBazaarSignature
2024-07-08 07:12:12b0ffabf374adbc679d06306312eb57add96acaafb72e66921afeb2b5aa3c9d6eelf  
2024-07-07 19:11:32b0ffabf374adbc679d06306312eb57add96acaafb72e66921afeb2b5aa3c9d6eelf  
2024-07-07 19:11:32b5d35eb49b85553c87019c274ae9de42b0514a8949ec28f8d61c642a780187b3elf 
2024-07-07 19:11:32d410edc3f58ae5fc315e6a991ec7f695ecec65695234fca528be1c7d87c8323bexe 
2024-07-07 19:11:32330bed455ff62446737e4d51044fde13aa3359a81e90262a618fdf2d9ab1510aelf