URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2025-04-27 14:04:59	35.220.197.233	233.197.220.35.bc.googleusercontent.com	Not listed	AS396982 GOOGLE-CLOUD-PLATFORM	HK	yes
2019-06-18 06:51:58	109.234.164.108	109-234-164-108.reverse.odns.fr	Not listed	AS50474 O2SWITCH	FR	no
2019-03-26 10:03:58	91.195.240.126		Not listed	AS47846 SEDO-AS	DE	no
2018-10-05 06:11:52	194.58.56.79		Not listed	AS57043 HOSTKEY-AS	CZ	no
2018-10-09 06:24:01	194.58.56.188		Not listed	AS57043 HOSTKEY-AS	CZ	no
2018-09-23 13:45:01	194.58.56.214		Not listed	AS57043 HOSTKEY-AS	CZ	no
2018-10-30 15:03:54	194.58.56.164		Not listed	AS57043 HOSTKEY-AS	CZ	no

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2018-07-04 22:44:19	http://best-writers-service.com/Pagada-Invocaci...	Offline	doc emotet epoch1 heodo	Cryptolaemus1
2018-07-02 21:30:09	http://best-writers-service.com/Facturas-pendie...	Offline	doc emotet epoch1 heodo	Cryptolaemus1
2018-06-29 23:56:24	http://best-writers-service.com/Nueva-Factura/	Offline	doc emotet epoch1 heodo	Cryptolaemus1

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2018-07-02 23:53:41	98be60ec830e2f1974e8d7ddd3626e88ad60476a36d3344662a08f1c9fb83182	doc		Heodo
2018-06-30 08:35:30	027c6eff88fad90897f116eb96b21980bdf0d89f36f72df4960726e3334331c6	doc		Heodo