URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2025-04-30 08:47:27	156.67.104.105	pinox.vntservers.net	Not listed	AS141995 CAPL-AS-AP	IN	yes
2020-08-06 17:29:09	173.212.212.243	ip-243-212-212-173.static.contabo.net	Not listed	AS51167 CONTABO	FR	no

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2020-12-01 08:56:04	http://balgruh.com/images/inside/winsconfig.exe	Offline	exe NanoCore	abuse_ch
2020-08-06 17:29:09	http://balgruh.com/fonts.exe	Offline	AveMariaRAT exe NanoCore	abuse_ch

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2020-12-01 08:56:04	0e244a9cc79a5fed85385c6fa767cd308fd2a09b69ee755e19464c52261332be	exe		NanoCore
2020-08-14 04:17:31	fd328d29886f3ccb5efdff563b5a17d27aa8887c8bf6b4e7bc4393efd1aa0c83	exe		AveMariaRAT
2020-08-14 00:44:29	fae3ee2a9f520f2b1dac5318ce4f9c7c757d6965f862642adb515d44f7b5a930	exe		AveMariaRAT
2020-08-06 17:29:08	e37567f8b0e6739f6ebb1664bd114f4c9c82210c9c6874e22ce1d4c641a351c8	exe		NanoCore