URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2025-04-30 05:52:47	119.148.18.108		Not listed	AS23923 AGNI-AS	BD	yes
2021-06-23 17:34:47	107.161.23.26	atlshared9.ramnode.com	Not listed	AS3842 RAMNODE	US	no
2021-01-21 15:22:10	172.104.53.156	172-104-53-156.ip.linodeusercontent.com	Not listed	AS63949 AKAMAI-LINODE-AP	SG	no

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2021-01-21 15:22:10	https://demo.edu-desk.net/bqnolqodx.zip	Offline	Dridex	stoerchl

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2021-01-22 05:12:11	1a38b43a61cad2fba9077942ee0abd2fa55cba21cf52a90603bbfed39147a22a	dll		Dridex
2021-01-22 04:11:57	e5a09287866a91d3c78e942d1e51dcd9f76d19dfbfed862e5e6a6d97b3f2644f	exe		Dridex
2021-01-21 23:30:09	6628e8dc46b9a20fd44b83573e692c13fbfd7a970d5062dfa3f4bc96e0989525	dll		Dridex
2021-01-21 20:11:30	71f29382dbfa7d636dcf5e1fc86bf628623dcf5d30fb08063e2594037dc7d9ff	dll		Dridex
2021-01-21 18:38:56	5f714d78dd03257b68bc16c365a1b87c5a661e889f83bed1f2c26c133702bc43	dll		Dridex
2021-01-21 17:07:57	d03842cdec5a9579fe22be85f7b32d836a027537cb7f4be0c7e65a5c24cb0d70	dll		Dridex
2021-01-21 15:57:24	be32fba6a8f831159b5ace409a4b3f6089c00681bf9b5e6561c58dbb4f033523	dll		Dridex
2021-01-21 15:22:09	4bfddde9f8b6c92a2436385cedf3f5acf3a3284a22f40390a503decad56eecf9	dll		Dridex