URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2019-12-13 07:43:34	104.28.18.250		Not listed	AS13335 CLOUDFLARENET	NZ	no
2019-12-13 07:43:34	104.28.19.250		Not listed	AS13335 CLOUDFLARENET	NZ	no
2019-09-29 07:48:23	159.69.118.33	static.33.118.69.159.clients.your-server.de	Not listed	AS24940 HETZNER-AS	DE	no
2019-09-29 07:48:23	159.69.44.32	static.32.44.69.159.clients.your-server.de	Not listed	AS24940 HETZNER-AS	DE	no
2019-09-29 07:48:23	78.47.89.88	static.88.89.47.78.clients.your-server.de	Not listed	AS24940 HETZNER-AS	DE	no
2019-01-18 09:01:11	109.234.164.18	109-234-164-18.reverse.odns.fr	Not listed	AS50474 O2SWITCH	FR	no

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2019-01-18 09:17:03	http://digimacmobiles.com/wp-content/languages/...	Offline	exe	zbetcheckin
2019-01-18 09:01:11	http://digimacmobiles.com/wp-includes/ID3/ssj.jpg	Offline	exe Troldesh	zbetcheckin

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2019-01-18 09:17:03	0b5ed93a5da40cec20f414028fab9ada951745455c8e982ff67ac39590b9768a	exe
2019-01-18 09:01:10	e43fb62c12fcf1be9f9982e81a59350a8f9dd2389198c0b332cef832a63aac0f	exe		Ransomware.Troldesh