URLhaus Database
Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).
Database Entry
| Host: | ext-checkdin.vercel.app |
|---|---|
| Spamhaus DBL : | Abused domain (phishing) |
| SURBL : | Blocked |
| Quad9 : | Blocked |
| AdGuard : | Not blocked |
| Cloudflare : | Blocked |
| ProtonDNS : | Not blocked |
| OpenBLD : | Not blocked |
| DNS4EU : | Not blocked |
| Control D HaGeZi : | Not blocked |
| Firstseen: | 2026-02-28 19:44:06 UTC |
| Total malware sites : | 4 |
| Online malware sites : | 2 (50%) |
| Offline Malware sites : | 2 (50%) |
| Newest active malware site : | 2026-02-28 19:44:12 UTC |
| Oldest active malware site : | 2026-02-28 19:44:10 UTC (Age: 18 hours, 25 minutes) |
| A record(s) observed : | 8 |
IP addresses
The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.
| Firstseen (UTC) | IP address | Hostname | SBL | ASN | Country | Active? |
|---|---|---|---|---|---|---|
| 2026-02-28 19:44:07 | 216.198.79.67 | Not listed | AS16509 AMAZON-02 |  US | yes | |
| 2026-02-28 19:44:07 | 64.29.17.67 | Not listed | AS16509 AMAZON-02 | US | yes | |
| 2026-02-28 19:44:12 | 216.198.79.3 | Not listed | AS16509 AMAZON-02 | US | no | |
| 2026-02-28 19:44:12 | 64.29.17.3 | Not listed | AS16509 AMAZON-02 | US | no | |
| 2026-03-01 01:36:06 | 216.198.79.131 | Not listed | AS16509 AMAZON-02 | US | no | |
| 2026-03-01 01:36:06 | 64.29.17.131 | Not listed | AS16509 AMAZON-02 | US | no | |
| 2026-02-28 19:44:08 | 64.29.17.195 | Not listed | AS16509 AMAZON-02 | US | no | |
| 2026-02-28 19:44:08 | 216.198.79.195 | Not listed | AS16509 AMAZON-02 | US | no |
Malware URLs
The table below shows all malware URLs that are associated with this particular host.
| Dateadded (UTC) | URL | Status | Tags | Reporter |
|---|---|---|---|---|
| 2026-02-28 19:44:12 | https://ext-checkdin.vercel.app/api/l | Online | BeaverTail DPRK NorthKorea npm ua-curl |  DaveLikesMalwre |
| 2026-02-28 19:44:10 | https://ext-checkdin.vercel.app/api/m | Online | BeaverTail DPRK NorthKorea npm ua-curl | DaveLikesMalwre |
| 2026-02-28 19:44:08 | http://ext-checkdin.vercel.app/api/tokenl?st=Nk... | Offline | BeaverTail DPRK NorthKorea npm ua-curl | DaveLikesMalwre |
| 2026-02-28 19:44:07 | https://ext-checkdin.vercel.app/api/w | Offline | BeaverTail DPRK NorthKorea npm ua-curl | DaveLikesMalwre |
The table below shows recent payloads delivery by this host.
| Firstseen (UTC) | SHA256 hash | File type | Bazaar | Signature |
|---|---|---|---|---|
| 2026-03-01 13:34:42 | 02327b06d4ab9453914c9beae25e2648a35ec848aede39091ce4cd8c53639a7c | sh | ||
| 2026-03-01 09:17:49 | d37c936e77e3b9185190ce906a551416baa4273e2aafced63a900b3438ef5c06 | sh | ||
| 2026-03-01 08:24:01 | 9998950401be061d45be70be00b5b37823cc2c194d4d464f7eec5d8ed475b3d4 | sh | ||
| 2026-03-01 02:58:56 | 25b6d8bbe40affff5dba4cf204ec6875867486d8cdef1f23c5f4dc70ebd62042 | sh | ||
| 2026-03-01 01:36:06 | 6de34ac1b49f1f6866276063c506c5abfd134432f33baa4469a06b5b8c2c257c | sh | ||
| 2026-02-28 19:44:12 | 37b9cf8e5db0c70ea36c63f6ca3bc0eaa5a15365153c30e4707759026d38ccb6 | sh | ||
| 2026-02-28 19:44:09 | 0c93de2d78b508b065fcb9dd0224b02b4b21c3db0ae905e0da2c42135edf314d | sh |