URLhaus Database
Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).
Database Entry
IP addresses
The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.
| Firstseen (UTC) | IP address | Hostname | SBL | ASN | Country | Active? |
|---|---|---|---|---|---|---|
| 2026-08-03 21:01:10 | 166.0.0.6 | Not listed | AS213229 MITELIS |  US | yes | |
| 2025-12-08 18:00:04 | 144.31.31.31 | waf.mitelis.net | Not listed | AS213229 MITELIS | US | no |
| 2026-07-21 22:19:06 | 166.0.0.66 | Not listed | AS213229 MITELIS | US | no | |
| 2026-07-24 23:57:55 | 193.23.208.220 | Not listed | AS213229 MITELIS | US | no | |
| 2026-06-25 01:42:06 | 166.0.0.166 | Not listed | AS213229 MITELIS | US | no | |
| 2026-01-26 13:42:27 | 166.0.0.0 | anycast.mitelis.net | Not listed | AS213229 MITELIS | US | no |
| 2026-06-23 13:02:36 | 193.23.208.115 | Not listed | AS213229 MITELIS | US | no | |
| 2025-12-08 22:17:41 | 64.188.88.88 | waf.mitelis.net | Not listed | AS213229 MITELIS | US | no |
| 2024-11-20 10:24:09 | 104.21.93.155 | Not listed | AS13335 CLOUDFLARENET | n/a | no | |
| 2024-11-20 10:24:09 | 172.67.211.183 | Not listed | AS13335 CLOUDFLARENET | n/a | no |
Malware URLs
The table below shows all malware URLs that are associated with this particular host.
| Dateadded (UTC) | URL | Status | Tags | Reporter |
|---|---|---|---|---|
| 2025-07-16 07:25:13 | https://api.ewfiles.net/api/files/B9ITWqj2o | Offline | QuasarRAT  |  JAMESWT_WT |
| 2024-11-20 10:37:05 | https://api.ewfiles.net/api/files/_DdldpxVX | Offline | AmosStealer |  JAMESWT_MHT |
| 2024-11-20 10:25:16 | https://api.ewfiles.net/api/files/Wft6eSFut | Offline | DarkGate | JAMESWT_MHT |
| 2024-11-20 10:25:12 | https://api.ewfiles.net/api/files/X8KuhJGO6 | Offline | PureCrypter | JAMESWT_MHT |
| 2024-11-20 10:24:20 | https://api.ewfiles.net/api/files/v3jA0e0bS | Offline | JAMESWT_MHT | |
| 2024-11-20 10:24:14 | https://api.ewfiles.net/api/files/7M7GSdepl | Offline | PureCrypter | JAMESWT_MHT |
| 2024-11-20 10:24:09 | https://api.ewfiles.net/api/files/y2NeIbvZn | Offline | JAMESWT_MHT |
The table below shows recent payloads delivery by this host.
| Firstseen (UTC) | SHA256 hash | File type | Bazaar | Signature |
|---|---|---|---|---|
| 2025-08-16 15:18:19 | 3803279044bccd2aaa4ce2d71960ef60e5fa99ff159975cc506096ee2fec4218 | txt | AmosStealer | |
| 2025-07-16 07:25:13 | d4d817b58a12f35048260a01358b2cf936bb2345c2860b2cb887bd554cd3b476 | exe | QuasarRAT | |
| 2024-11-20 10:25:16 | 630acefe136ea2e4bb95211a214e4829d8cb59d4d948b09221e61acd278854bf | msi | DarkGate | |
| 2024-11-20 10:25:12 | 5f2b53f1b119cc3e39c36c94e237e2cecdbeeb688ed0d2ae1365fb75a608c86f | exe | PureCrypter | |
| 2024-11-20 10:24:20 | a88027973b8ec9183f859f9b8164e0ed4fcc4612ebc8e0bafc57ceaae9048326 | exe | ||
| 2024-11-20 10:24:14 | f64bc188c245bf2bc9f191521eaeec61a67429feaddf08e9706e2c00f9608fbb | exe | PureCrypter | |
| 2024-11-20 10:24:09 | 43d710e73bdd78c9f7f58143baae1496916cc032a31862f2a1394e30aa805391 | exe |