URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2021-01-21 18:00:06	35.159.22.77	ec2-35-159-22-77.eu-central-1.compute.amazonaws.com	Not listed	AS16509 AMAZON-02	DE	yes

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2021-01-21 18:00:06	http://35.159.22.77/mkts/d1.exe	Offline	exe Formbook opendir	abuse_ch
2021-01-21 18:00:06	http://35.159.22.77/mkts/d2.exe	Offline	exe Formbook opendir	abuse_ch

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2021-01-25 02:34:48	9ba1b16e84be57d419e0a19248f13f186bcf9a2d98e97936e16d1fceb0357b97	exe		Formbook
2021-01-25 02:31:08	d63c5bbfea14e5cbfc013e0df1c94ff9eb0ea87d95bcd3fb8ff9047cd58dc8aa	exe		Formbook
2021-01-22 12:12:20	ab1b84fb6369906a05e14bb875abd6c08f3609a62f38f19e1f3d0db75be1fc94	exe
2021-01-22 12:00:59	481a9fe798318c18b553706e1017ee3e161566a0029e553ac3a1e74aadcbe793	exe
2021-01-22 08:05:48	35a7a076fe3192eba856436a4ae3f91a97a865e12fbf552742a48add7b3ce3ea	exe
2021-01-22 07:54:41	683bc037d3cdc825578c3ab73c20efb635728c44ef5c1ae8daa1d3d393e85ce6	exe
2021-01-22 07:43:12	584caf8e7b92a65a79f911aef6d4f141e4d5af543a93df214bc89b7aef3e2199	exe
2021-01-21 18:00:06	2938b38c785f109befe2eb2768082aea672c27e978e52998a4bca8526b1a669f	exe		Formbook
2021-01-21 18:00:06	40acc1cfe1986fee292469e21c175d68bed0502f46af424d0cd8ec42e0ead72d	exe		Formbook