URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2020-06-10 18:14:11	52.251.53.210		Not listed	AS8075 MICROSOFT-CORP-MSN-AS-BLOCK	US	yes

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2020-06-10 18:15:21	http://bencalizo.duckdns.org/kay.exe	Offline	AgentTesla exe opendir	abuse_ch
2020-06-10 18:14:48	http://bencalizo.duckdns.org/oj.exe	Offline	AgentTesla exe opendir	abuse_ch
2020-06-10 18:14:11	http://bencalizo.duckdns.org/musky.exe	Offline	AgentTesla exe opendir	abuse_ch

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2020-06-11 01:58:19	6df488a50a414fd27a301c9edbfc775f8e74748dd41baae171b9667e6bfc6513	exe		AgentTesla
2020-06-10 18:15:21	8bf29373cc2b67e3127fb655434ca8fb204d5189fe94163207a0300af787d060	exe		AgentTesla
2020-06-10 18:14:48	2c15880ab47cd785c59229616789de898380c42f6204d926409184c32543cac2	exe		AgentTesla
2020-06-10 18:14:10	8a1996e7954954071c7744530ef5a31a93ee9ff5cce447611f622f88718ab1b4	exe		AgentTesla