URLhaus Database
Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).
Database Entry
| Host: | aair.org.ro |
|---|---|
| Domain registrar: | n/a |
| Domain registration date: | 2004-10-18 00:00:00 UTC |
| Spamhaus DBL : | Abused domain (botnet C&C) |
| SURBL : | Not blocked |
| Quad9 : | Blocked |
| AdGuard : | Blocked |
| Cloudflare : | Blocked |
| ProtonDNS : | Blocked |
| OpenBLD : | Blocked |
| DNS4EU : | Not blocked |
| Control D HaGeZi : | Not blocked |
| Firstseen: | 2026-07-07 11:57:06 UTC |
| Total malware sites : | 8 |
| Online malware sites : | 0 (0%) |
| Offline Malware sites : | 8 (100%) |
| A record(s) observed : | 2 |
IP addresses
The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.
| Firstseen (UTC) | IP address | Hostname | SBL | ASN | Country | Active? |
|---|---|---|---|---|---|---|
| 2026-07-08 19:03:37 | 86.107.78.169 | cw86-a0g-gh169.romania-webhosting.com | Not listed | AS203053 ClausWEB |  RO | yes |
| 2026-07-07 11:57:08 | 86.107.78.50 | cw86-a0g-gh50.romania-webhosting.com | Not listed | AS203053 ClausWEB | RO | no |
Malware URLs
The table below shows all malware URLs that are associated with this particular host.
| Dateadded (UTC) | URL | Status | Tags | Reporter |
|---|---|---|---|---|
| 2026-07-07 12:35:10 | https://aair.org.ro/Udfl140.mdp | Offline | ascii GuLoader  |  abuse_ch |
| 2026-07-07 12:33:06 | https://aair.org.ro/CityhJdWumJsAbpTjJzbL76.bin | Offline | encrypted GuLoader | abuse_ch |
| 2026-07-07 12:32:07 | https://aair.org.ro/Bryog.thn | Offline | ascii Encoded GuLoader | abuse_ch |
| 2026-07-07 12:32:07 | https://aair.org.ro/bbUsQZjjwh110.bin | Offline | AgentTesla encrypted GuLoader | abuse_ch |
| 2026-07-07 12:27:07 | https://aair.org.ro/Deor.xsn | Offline | AgentTesla ascii Encoded GuLoader | abuse_ch |
| 2026-07-07 11:58:07 | https://aair.org.ro/Zoroaster.dwp | Offline | AgentTesla ascii Encoded GuLoader | abuse_ch |
| 2026-07-07 11:57:08 | https://aair.org.ro/Rema.psp | Offline | AgentTesla ascii Encoded GuLoader | abuse_ch |
| 2026-07-07 11:57:08 | https://aair.org.ro/pGsWdCez63.bin | Offline | AgentTesla encrypted GuLoader | abuse_ch |
The table below shows recent payloads delivery by this host.
| Firstseen (UTC) | SHA256 hash | File type | Bazaar | Signature |
|---|---|---|---|---|
| 2026-07-07 12:35:10 | cabedca993a0e0dcccf97140ce3e0c656d2959b70b306170140aa4f16a48bb9d | txt | ||
| 2026-07-07 12:33:06 | 926e4dee15bffa9af21d39917477ccb6b619c8a040e4f23d0aec81a9ffd47c54 | unknown | ||
| 2026-07-07 12:32:07 | b5add7a3cfb81d70066a02558913123746e42505342f2fee3273b290a62ea06f | txt | ||
| 2026-07-07 12:32:07 | cc688db1d175227338f5631ebea56b03e3185a33082dbf2d062ec8125abd9538 | unknown | ||
| 2026-07-07 12:27:07 | 9ff2c2120069a25097785e0d8f4756a47d9a439181b73e874074c25ca8564569 | txt | ||
| 2026-07-07 11:58:07 | 272cda1dc9d0e2fddde6aa18448c52a172876b1832b1c8748d26aa16a52558c8 | txt | ||
| 2026-07-07 11:57:08 | e34a9e118a69fa72b53006e69063ad44b549bae9b14e116a150282ac83b9ff6e | txt | ||
| 2026-07-07 11:57:08 | 10edc930c09d207125bd8f731b8bfd6bfb8f9b364966d1934884268a01d689db | unknown |