URLhaus Database
Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).
Database Entry
IP addresses
The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.
| Firstseen (UTC) | IP address | Hostname | SBL | ASN | Country | Active? |
|---|---|---|---|---|---|---|
| 2025-10-16 21:55:02 | 45.88.172.132 | aed3.fvds.ru | Not listed | AS216154 CLODO |  NL | yes |
| 2025-04-30 11:16:28 | 213.174.157.150 | s101.ucoz.net | Not listed | AS39572 ADVANCEDHOSTERS-AS | NL | no |
| 2024-12-07 14:38:19 | 195.216.243.33 | s33.ucoz.net | Not listed | AS57724 DDOS-GUARD |  RU | no |
Malware URLs
The table below shows all malware URLs that are associated with this particular host.
| Dateadded (UTC) | URL | Status | Tags | Reporter |
|---|---|---|---|---|
| 2024-12-07 14:38:27 | https://4d6gcx7h.moy.su/server/dos.bat | Offline | BABADEDA darkylock Ransomware |  abus3reports |
| 2024-12-07 14:38:24 | https://4d6gcx7h.moy.su/server/server.bat | Offline | darkylock njRAT  Ransomware | abus3reports |
| 2024-12-07 14:38:19 | https://4d6gcx7h.moy.su/uploaderservice/2022022... | Offline | darkylock Formbook Ransomware | abus3reports |
The table below shows recent payloads delivery by this host.
| Firstseen (UTC) | SHA256 hash | File type | Bazaar | Signature |
|---|---|---|---|---|
| 2024-12-07 14:38:27 | d2a1fb8c2c9b6bedb7274bcc69f94dc67de12d23d221e7f474042eee7ce414ac | exe | Babadeda | |
| 2024-12-07 14:38:24 | 27f907d49acfadec766589e03ed4c3d32ab1b7199f32a3f2a61b47f3a0f2c91a | exe | njrat | |
| 2024-12-07 14:38:18 | 17ae76a097f84276cd2f4f1e8a6e233b8c88840b4ddbfb35a58c9f95b286675c | exe | Formbook |