URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry


Host: 47.237.15.69
Firstseen:2025-12-31 23:22:04 UTC
Total malware sites :5
Online malware sites :0 (0%)
Offline Malware sites :5 (100%)

IP addresses


The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)IP addressHostnameSBLASNCountryActive?
2025-12-31 23:25:54 47.237.15.69Not listedAS45102 ALIBABA-CN-NET- SGyes

Malware URLs


The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)URLStatusTagsReporter
2026-01-01 11:41:06http://47.237.15.69:3389/shell.ps1Offlineps1 JAMESWT_WT
2025-12-31 23:26:08http://47.237.15.69:3389/s.ps1Offlinepersistence ps1 BlinkzSec
2025-12-31 23:26:05http://47.237.15.69:3389/OneDrive.exeOfflinehuntio opendir Sliver BlinkzSec
2025-12-31 23:25:59http://47.237.15.69:3389/z_App.exeOfflinehuntio opendir Sliver BlinkzSec
2025-12-31 23:25:54http://47.237.15.69:3389/App.binOfflinehuntio opendir Sliver BlinkzSec

The table below shows recent payloads delivery by this host.

Firstseen (UTC)SHA256 hashFile typeBazaarSignature
2026-01-01 11:41:066e7e533d81d8defa4840d418e0216dae2cc0470e4188e48b2d8853068532c2c6txt 
2025-12-31 23:26:052538486ced17a0a28ee2f4f8e8ba037b59e817ac398cdf712e313602473827beexeSliver
2025-12-31 23:25:5955a24ce56c8fbd41ffa5de566c0b95ec83f48cc3ce5309e65be881bc32d2fd69exeSliver
2025-12-31 23:25:54485a464b2c2bdcf617c7793222301140d47b2a929bb2e2efdaf455333de769dcelfSliver