URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

Host:	faceks.com
Domain registrar:	Alibaba
Domain registration date:	2012-05-11 09:24:30 UTC
Spamhaus DBL :	Not blocked
SURBL :	Not blocked
Quad9 :	Not blocked
AdGuard :	Not blocked
Cloudflare :	Not blocked
ProtonDNS :	Not blocked
OpenBLD :	Not blocked
DNS4EU :	Blocked
Control D HaGeZi :	Not blocked
Firstseen:	2021-11-17 09:36:06 UTC
Total malware sites :	7
Online malware sites :	0 (0%)
Offline Malware sites :	7 (100%)
A record(s) observed :	6

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2025-04-27 08:32:33	47.98.132.25		Not listed	AS37963 ALIBABA-CN-NET	CN	yes
2023-03-30 11:16:01	156.224.18.43		Not listed	AS134365 ANSHENG-AS-AP	HK	no
2022-08-30 16:48:28	38.55.203.29		Not listed	AS400619 AROSS-AS	US	no
2022-08-25 07:00:37	45.195.68.230		Not listed	AS27951 Media_Commerce_Partners_S.A	CO	no
2021-12-24 05:33:38	154.222.31.30		Not listed	AS401696 COGNETCLOUD	SC	no
2021-11-17 09:36:09	154.91.153.17		Not listed	AS395793 ARISK-COMMUNICATIONS-INC	US	no

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2021-12-01 18:00:20	http://faceks.com/wp-admin/8UzD1qk0/	Offline	emotet epoch4 redir-appinstaller	sugimu_sec
2021-12-01 07:27:15	http://faceks.com/wp-admin/Rml2/	Offline	emotet epoch4 redir-appinstaller	sugimu_sec
2021-12-01 03:58:09	http://faceks.com/wp-admin/Rml2	Offline	emotet epoch4 redir-appinstaller	waga_tw
2021-11-26 23:58:08	http://faceks.com/wp-admin/Nx10I8SM/	Offline	doc emotet epoch4 redir-appinstaller	Cryptolaemus1
2021-11-26 23:46:04	https://faceks.com/wp-admin/Nx10I8SM/	Offline	doc emotet epoch4 redir-appinstaller	Cryptolaemus1
2021-11-26 14:40:10	http://faceks.com/wp-admin/Nx10I8SM	Offline	emotet epoch4 redir-appinstaller	waga_tw
2021-11-17 09:36:09	http://faceks.com/wp-admin/XO9RwCxewiS3i/	Offline	doc emotet epoch4 heodo	Cryptolaemus1

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2021-12-01 18:30:44	88348096ce2f00c83b5de584f98a7304208f0d25d541886a92b70e404835e8c7	html
2021-12-01 18:00:19	e17d9994ef0198bb034d1e88ae2d8690c7386e7b408e5149c0bcbd7b2d79e773	html
2021-12-01 07:27:15	e17d9994ef0198bb034d1e88ae2d8690c7386e7b408e5149c0bcbd7b2d79e773	html
2021-12-01 03:58:09	e17d9994ef0198bb034d1e88ae2d8690c7386e7b408e5149c0bcbd7b2d79e773	html
2021-11-26 23:58:08	0484de3382f65aced8204dbff7c33eb4895f30d9dd835b2020449f8e2e253229	html
2021-11-26 14:56:37	0484de3382f65aced8204dbff7c33eb4895f30d9dd835b2020449f8e2e253229	html
2021-11-17 09:36:08	06012c700c1dac4c122303e920fdf1c71c41e681673c241c9698e5766df275a8	docm		Heodo