URLhaus Database
Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).
Database Entry
IP addresses
The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.
| Firstseen (UTC) | IP address | Hostname | SBL | ASN | Country | Active? |
|---|---|---|---|---|---|---|
| 2025-06-06 07:05:07 | 72.167.135.53 | 53.135.167.72.host.secureserver.net | Not listed | AS398101 GO-DADDY-COM-LLC |  US | yes |
| 2023-06-16 22:37:04 | 64.202.184.79 | ip-64-202-184-79.ip.secureserver.net | Not listed | AS26496 AS-26496-GO-DADDY-COM-LLC | US | no |
| 2022-12-21 12:34:54 | 209.99.40.222 | 209-99-40-222.fwd.datafoundry.com | Not listed | AS23005 SWITCH-LTD | US | no |
| 2022-12-08 00:19:17 | 200.24.13.70 | fulgore.inc.cl | Not listed | AS262256 Servicios_Informticos_Hostname_Ltda |  CL | no |
Malware URLs
The table below shows all malware URLs that are associated with this particular host.
| Dateadded (UTC) | URL | Status | Tags | Reporter |
|---|---|---|---|---|
| 2022-12-08 01:35:12 | http://elauki.com/redir-hsbc/alomaxi.exe | Offline | dropped-by-amadey |  viql |
| 2022-12-08 00:19:17 | http://elauki.com/redir-hsbc/anpfixmain.exe | Offline | dropped-by-amadey RemcosRAT  | viql |
The table below shows recent payloads delivery by this host.
| Firstseen (UTC) | SHA256 hash | File type | Bazaar | Signature |
|---|---|---|---|---|
| 2022-12-08 01:35:12 | 40f161bd3edb4feb15b3fb13f91390e800973775a6ddb5fb578bb34514337cb6 | exe | ||
| 2022-12-08 00:19:11 | 9e2bf00ed331c02f9ce582339b8cc771a5422998154b7310a5b3bbcc8fc2dc6c | exe | RemcosRAT |