URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

Host:	ehs.co.zw
Spamhaus DBL :	Not blocked
SURBL :	Not blocked
Quad9 :	Not blocked
AdGuard :	Not blocked
Cloudflare :	Not blocked
ProtonDNS :	Not blocked
OpenBLD :	Not blocked
DNS4EU :	Not blocked
Control D HaGeZi :	Not blocked
Firstseen:	2021-04-16 15:00:04 UTC
Total malware sites :	9
Online malware sites :	0 (0%)
Offline Malware sites :	9 (100%)
A record(s) observed :	2

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2021-06-18 20:38:07	176.32.230.50	web306.extendcp.co.uk	Not listed	AS20738 GD-EMEA-DC-LD5	GB	yes
2021-04-16 15:00:05	192.236.163.51	client-192-236-163-51.hostwindsdns.com	Not listed	AS54290 HOSTWINDS	US	no

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2021-04-20 13:19:04	http://ehs.co.zw/veron/fad/Wj7R1Fd4luz1nGs.exe	Offline	AgentTesla exe	zbetcheckin
2021-04-20 13:15:04	http://ehs.co.zw/veron/dj/O73jpH5gC4FjsrZ.exe	Offline	AgentTesla exe	zbetcheckin
2021-04-20 13:14:33	http://ehs.co.zw/veron/ef/j6lPAi8ei08vYtt.exe	Offline	AgentTesla exe	zbetcheckin
2021-04-20 13:14:21	http://ehs.co.zw/veron/ok/lrrDXT9Ki8uX1AU.exe	Offline	AgentTesla exe	zbetcheckin
2021-04-20 13:14:06	http://ehs.co.zw/veron/bo/OuhG2j4d9cP8mkZ.exe	Offline	AgentTesla exe	zbetcheckin
2021-04-20 13:14:04	http://ehs.co.zw/veron/dec/V7xj0esEUgFxjyl.exe	Offline	AgentTesla exe	zbetcheckin
2021-04-20 13:14:04	http://ehs.co.zw/veron/ja/dJmxBVmgOdaTg5G.exe	Offline	AgentTesla exe	zbetcheckin
2021-04-20 12:17:04	http://ehs.co.zw/veron/sik/FOFpJL1H68YigMz.exe	Offline	AgentTesla exe	abuse_ch
2021-04-16 15:00:05	http://ehs.co.zw/abobi/isur/INVOICE.exe	Offline	AgentTesla exe	abuse_ch

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Signature
2021-04-20 13:29:19	6f14396f619147aaa06487cdb10f71df3e7bf0da19aebe34aacc8b0b2b176d4f	exe	AgentTesla
2021-04-20 13:19:04	edc9ed2f2a8074eb2a9ae1516e179ad4a5e97a495b4183011854d5272e94097e	exe	AgentTesla
2021-04-20 13:15:04	806543c5b925cac1e0db9abbb28ae330fbb323d68946599fdc32402bf7e1f49a	exe	AgentTesla
2021-04-20 13:14:21	332e324313c3bbbae4fb70a55b8fa39998e972c476fedfbb41bf1ad83889f453	exe	AgentTesla
2021-04-20 13:14:06	b8ff56a3f38384dcd38e3eee204d84a046364226151687fba057c75fb987c15d	exe	AgentTesla
2021-04-20 13:14:04	efa152e0842d89a6f2f13a29fb89248d74027a6cc8ed7f18cf2f670da1232bad	exe	AgentTesla
2021-04-20 13:14:04	ca831dbe47d3934cd62ff5829cb585d4cb2fdec2b5380f775867f9666448ee82	exe	AgentTesla
2021-04-20 12:43:14	2af9a6224f6007da01386aefa8ed531fcfb3761a31f3c2e3ae977005449682d3	exe	AgentTesla