URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

Host:	anincrush32.my.id
Domain registrar:	n/a
Domain registration date:	2023-04-09 13:09:04 UTC
Spamhaus DBL :	Not blocked
SURBL :	Not blocked
Quad9 :	Status unknown
AdGuard :	Not blocked
Cloudflare :	Not blocked
ProtonDNS :	Status unknown
OpenBLD :	Not blocked
DNS4EU :	Not blocked
Control D HaGeZi :	Not blocked
Firstseen:	2023-05-05 05:46:09 UTC
Total malware sites :	5
Online malware sites :	0 (0%)
Offline Malware sites :	5 (100%)
A record(s) observed :	20

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2023-09-17 14:51:29	198.204.242.115		Not listed	AS33387 NOCIX	US	no
2023-09-17 10:08:41	64.176.36.193	64.176.36.193.vultrusercontent.com	Not listed	AS20473 AS-VULTR	JP	no
2023-09-11 02:22:35	198.204.242.118	host.lalzyx.live	Not listed	AS33387 NOCIX	US	no
2023-09-13 02:22:33	45.76.192.98	45.76.192.98.vultrusercontent.com	Not listed	AS20473 AS-VULTR	JP	no
2023-09-12 13:17:26	198.204.242.113		Not listed	AS33387 NOCIX	US	no
2023-09-08 23:23:02	198.204.242.116		Not listed	AS33387 NOCIX	US	no
2023-09-03 21:01:54	198.204.242.117		Not listed	AS33387 NOCIX	US	no
2023-08-30 05:07:58	38.54.108.131		SBL652402	AS138915 KAOPU-HK	US	no
2023-08-24 23:45:17	170.64.150.106		Not listed	AS14061 DIGITALOCEAN-ASN	AU	no
2023-08-21 13:48:11	104.236.5.145	1103714.cloudwaysapps.com	Not listed	AS14061 DIGITALOCEAN-ASN	US	no

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2023-05-08 00:12:10	https://anincrush32.my.id/shinox2.1.exe	Offline	32 exe Formbook	zbetcheckin
2023-05-08 00:12:10	https://anincrush32.my.id/koriga2.1.exe	Offline	32 AgentTesla exe	zbetcheckin
2023-05-08 00:11:10	https://anincrush32.my.id/macois2.1.exe	Offline	32 AgentTesla exe	zbetcheckin
2023-05-07 00:39:09	https://anincrush32.my.id/islight2.1.exe	Offline	32 AgentTesla exe	zbetcheckin
2023-05-05 05:46:12	https://anincrush32.my.id/ostaj2.1.exe	Offline	AveMariaRAT exe rat	abuse_ch

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Signature
2023-05-08 00:12:10	4ba8bb8c08c2ca600d1359b3533af1b50e93083858305d320d30de47a89652b8	exe	Formbook
2023-05-08 00:12:10	dfa3a339379ee6ce3bbd7730207cce6f1ad6f88e8c4f3ff7dc300cfe28da0a6c	exe	AgentTesla
2023-05-08 00:11:10	87da8a3667cd660f0461d3f41f5465f9b3f21f4426e5f5ca3295e347e911a246	exe	AgentTesla
2023-05-07 02:18:36	14b4f36af1e77933e2f869e534832b03a81c3c75862e3912800c322dccd387fa	exe	AgentTesla
2023-05-05 08:02:44	ed5f71edcd297159229c6f8eb7894d5df258826136a6631f9107381da63f678b	exe	AveMariaRAT
2023-05-05 05:46:12	fdc1e03bf63233726510fb932526e402628b13a423f15a5b5c92835cb8a4682f	exe	AveMariaRAT