URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2021-03-04 07:36:06	46.21.153.231	231.153.21.46.static.swiftway.net	Not listed	AS29802 HVC-AS	US	yes

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2021-03-09 12:38:12	http://46.21.153.231/josh/vbc.exe	Offline	exe Formbook opendir	abuse_ch
2021-03-06 05:58:06	http://46.21.153.231/pama/win32.exe	Offline	exe Formbook opendir	abuse_ch
2021-03-04 10:24:05	http://46.21.153.231/doyin/vbc.exe	Offline	exe Formbook opendir	abuse_ch
2021-03-04 07:36:06	http://46.21.153.231/akanbi/win32.exe	Offline	exe Formbook	abuse_ch

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2021-03-11 05:58:46	f51814c09f1be4842eacf33e683f36ed4182a5f19ce3ba905b90261d1d2489b1	exe		Formbook
2021-03-09 12:38:12	f4738e611922161d38399f61ebe6c8332bbf3e54f1d23475c0bf0b476d05a1df	exe		Formbook
2021-03-06 05:58:06	6c131f342e8226706ba1b39cc955852b022130c14ea12bd3b3cf340bbea25bf6	exe		Formbook
2021-03-04 10:24:05	21ba0bed0b05a2ce68496e73a5c103fb5b815ac2c77e997f46e5d09666c1c978	exe		Formbook
2021-03-04 07:36:06	92f656d44d38fbc5e7964e36634bf95d18e157228624d1b38ea933633579ddc4	exe		Formbook