URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name). This page shows all malware URLs that are associated with the host 37e0b7ed.ngrok.io.

Database Entry


Host:37e0b7ed.ngrok.io
Spamhaus DBL:Phishing domain
SURBL:Not listed
Firstseen:2018-11-28 08:51:01

IP addresses


The table below shows all IP address obsered for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones).

Firstseen (UTC)IP addressHostnameSBLASNCountryActive?
2018-11-29 06:56:3152.15.72.7903.edge.prod.oh.ngrok.comNot listedAS16509 AMAZON-02 - Amazon.com, Inc.- USyes
2018-11-28 17:28:5452.15.183.14902.edge.prod.oh.ngrok.comNot listedAS16509 AMAZON-02 - Amazon.com, Inc.- USno
2018-11-28 17:26:2452.15.194.2800.edge.prod.oh.ngrok.comNot listedAS16509 AMAZON-02 - Amazon.com, Inc.- USno
2018-11-28 14:57:3352.15.62.1301.edge.prod.oh.ngrok.comNot listedAS16509 AMAZON-02 - Amazon.com, Inc.- USno
2018-11-28 12:41:2618.216.53.253ec2-18-216-53-253.us-east-2.compute.amazonaws.comNot listedAS16509 AMAZON-02 - Amazon.com, Inc.- USno
2018-11-28 08:51:1352.14.61.47ec2-52-14-61-47.us-east-2.compute.amazonaws.comNot listedAS16509 AMAZON-02 - Amazon.com, Inc.- USno

Malware URLs


The table below shows all malware URLs that are associated with this particulare host.

Dateadded (UTC)URLStatusTagsGSBReporter
2018-11-28 19:34:02http://37e0b7ed.ngrok.io/scan/host.htmlOfflinehta Loader Clean@de_aviation
2018-11-28 19:31:09http://37e0b7ed.ngrok.io/scan/svshost.exeOfflineexe Loki Clean@de_aviation
2018-11-28 19:29:10http://37e0b7ed.ngrok.io/scan/winsc.exeOfflineexe Loki lokibot NanoCore njRAT rat Clean@de_aviation
2018-11-28 08:51:13https://37e0b7ed.ngrok.io/scan/winsc.exeOfflineLoki NanoCore Clean@Racco42