URLhaus Database
Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).
Database Entry
IP addresses
The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.
| Firstseen (UTC) | IP address | Hostname | SBL | ASN | Country | Active? |
|---|---|---|---|---|---|---|
| 2025-04-27 15:06:01 | 93.84.119.237 | s2.open.by | Not listed | AS6697 BELPAK-AS |  BY | yes |
| 2022-01-26 13:34:09 | 93.84.119.241 | s6.open.by | Not listed | AS6697 BELPAK-AS | BY | no |
Malware URLs
The table below shows all malware URLs that are associated with this particular host.
| Dateadded (UTC) | URL | Status | Tags | Reporter |
|---|---|---|---|---|
| 2022-01-26 13:34:09 | https://bet-on.by/cgi-bin/RAma4y/ | Offline | dll emotet  epoch4 heodo |  Cryptolaemus1 |
The table below shows recent payloads delivery by this host.
| Firstseen (UTC) | SHA256 hash | File type | Bazaar | Signature |
|---|---|---|---|---|
| 2022-01-26 15:24:51 | 6a80e20136c45c1d4f7df68bd08f98a1b6f23e7908a03be9f281fee78e350e07 | dll | Heodo | |
| 2022-01-26 14:59:41 | 7ec77f381519f10f600ac86b09d529fa54347b5c44dc0f2aa01e30f41169712e | dll | Heodo | |
| 2022-01-26 14:23:01 | 4890fa2f24374911bf4017da74dd124f2f13af60d398b95000cd5172b4bac65a | dll | Heodo | |
| 2022-01-26 14:03:37 | 325aa9069ae096f39f7ebeeed14783b5379537497fac22e4fcd70e35477dbcee | dll | Heodo | |
| 2022-01-26 13:57:35 | adebff3a9b0a98ad6dccaed3c1c1190f6481e2cb4ebbaf59cb06b9b1956f7a8f | dll | Heodo | |
| 2022-01-26 13:34:09 | b11f8b943cf5b85ba26be44bcce3e9dfff59ad5ae8cd4e197137f445448c54d7 | dll | Heodo |