URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry


Host: 47.109.48.57
Firstseen:2025-06-16 21:36:04 UTC
Total malware sites :2
Online malware sites :1 (50%)
Offline Malware sites :1 (50%)
Newest active malware site :2025-06-16 21:36:34 UTC
Oldest active malware site :2025-06-16 21:36:34 UTC (Age: 8 months, 16 days, 6 hours, 37 minutes)

IP addresses


The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)IP addressHostnameSBLASNCountryActive?
2025-06-16 21:36:34 47.109.48.57SBL692520AS37963 ALIBABA-CN-NET- CNyes

Malware URLs


The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)URLStatusTagsReporter
2026-02-08 17:41:13https://47.109.48.57/02.08.2022.exeOfflinecensys CobaltStrike ext shellcode NDA0E
2025-06-16 21:36:34http://47.109.48.57/02.08.2022.exeOnlinecensys CobaltStrike ext DaveLikesMalwre

The table below shows recent payloads delivery by this host.

Firstseen (UTC)SHA256 hashFile typeBazaarSignature
2026-02-08 17:41:13873cc698a1d6f976e8cafda1da81b89bcd68e123539c0eb4808321bfca5bf8a3unknown  
2025-09-12 07:12:30d2ebb66a038c520b9f49d489ad9ada2e6c0ed58836af578f1f090bc3faec0786unknown  
2025-09-02 01:53:10e45d4baf5c4163c45019fd345d60a86dbcb27180f062991ff2b63a2b03c63cc6unknown  
2025-06-29 22:20:28e1a976f0532e8fa9605f499e293cf34c4e5c142c77a81897d628432573111ab8unknown  
2025-06-17 05:18:093c6ec83eed3f96387e164ba7aa7c68def63bef6b78eee233d0893e7f8bf490f8unknown