URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

Host: covidglobalupdate.myftp.biz
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Blocked
ProtonDNS :Not blocked
OpenBLD :Blocked
DNS4EU :Blocked
Control D HaGeZi :Not blocked
Firstseen:2020-06-03 03:00:33 UTC
Total malware sites :1
A record(s) observed :19

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)IP addressHostnameSBLASNCountryActive?
2020-06-25 09:16:56 105.112.97.44Not listedAS36873 VNL1-AS- NGno
2020-06-24 05:17:09 79.134.225.12Not listedAS6775 FINK-TELECOM-SERVICES- CHno
2020-06-25 06:16:56 105.112.96.148SBL637528AS36873 VNL1-AS- NGno
2020-06-25 00:17:36 105.112.97.206Not listedAS36873 VNL1-AS- NGno
2020-06-24 03:19:03 105.112.97.247Not listedAS36873 VNL1-AS- NGno
2020-06-07 14:32:48 185.244.30.251Not listedAS211619 MAXKO- PLno
2020-06-23 05:18:37 197.210.84.40Not listedAS29465 VCG-AS- NGno
2020-06-23 03:19:21 197.210.227.254Not listedAS29465 VCG-AS- NGno
2020-06-18 12:20:32 105.112.99.139Not listedAS36873 VNL1-AS- NGno
2020-06-17 12:21:41 105.112.107.245Not listedAS36873 VNL1-AS- NGno

Malware URLs

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)URLStatusTagsReporter
2020-06-03 03:00:37http://covidglobalupdate.myftp.biz/lee.exeOfflineexe NanoCore ext zbetcheckin

The table below shows recent payloads delivery by this host.

Firstseen (UTC)SHA256 hashFile typeBazaarSignature
2020-06-03 03:00:37062cf3944b0b563efc115688ff8910721db670950acf80c0020351b7d97b48c5exeNanoCore