URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2021-11-09 16:57:43	37.48.65.154		Not listed	AS60781 LEASEWEB-NL-AMS-01	NL	no
2021-11-14 02:29:27	37.48.65.155		Not listed	AS60781 LEASEWEB-NL-AMS-01	NL	no
2021-11-25 02:08:56	37.48.65.152		Not listed	AS60781 LEASEWEB-NL-AMS-01	NL	no
2021-11-28 14:55:07	199.115.115.118		Not listed	AS30633 LEASEWEB-USA-WDC	US	no
2021-12-15 13:56:42	81.171.22.4		Not listed	AS60781 LEASEWEB-NL-AMS-01	NL	no
2021-11-16 13:59:34	81.171.22.5		Not listed	AS60781 LEASEWEB-NL-AMS-01	NL	no
2021-11-11 06:40:52	37.48.65.151		Not listed	AS60781 LEASEWEB-NL-AMS-01	NL	no
2021-11-27 14:08:10	81.171.22.7		Not listed	AS60781 LEASEWEB-NL-AMS-01	NL	no
2021-11-18 11:20:52	185.107.56.198		Not listed	AS43350 NFORCE	NL	no
2021-11-12 21:24:57	81.171.22.6		Not listed	AS60781 LEASEWEB-NL-AMS-01	NL	no

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2021-02-17 21:45:43	https://aboalnsr.com/pbwamlk.rar	Offline	Dridex	stoerchl

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2021-02-18 09:00:51	e56c7afb6712cd3edda9400e15c8834477a26443575404b22bb92b137289c1b9	dll		Dridex
2021-02-18 04:08:37	ff3a35ebb7a529054539464c438c1ac920647e55dac7e8f853cf33c2bfc6da7b	dll		Dridex
2021-02-17 21:45:42	375b074151ad601e467078321beb924d344b977a8b3594c29596954ed20a9995	dll		Dridex