URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2025-04-28 09:33:53	164.160.91.44	cp52-jhb.za-dns.com	Not listed	AS328037 Elitehost	ZA	yes
2022-07-01 15:47:06	129.232.138.8	dedi969.jnb3.host-h.net	Not listed	AS37153 xneelo	ZA	no

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2022-07-01 15:47:06	http://firestoppers.co.za/language/L7bx4/	Offline	dll emotet epoch4 heodo	Cryptolaemus1

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2022-07-01 17:11:27	ba11dad94d8a61dca348482eb9b45e6e96e2287c893bccf1137b09d5a1b22a73	dll		Heodo
2022-07-01 16:59:28	16ff86ebea750c999fbe72a8d9d1f8ce70f840da25af617794484e8433839c1f	dll		Heodo
2022-07-01 16:48:57	1e2247a57d812a33f2af15955a93cc9490caae26bfc582cdd6c070da5178be84	dll		Heodo
2022-07-01 16:37:33	4b1f6e7b9dc0347a148dd139b928756f188b190c951beed27f388ad2289795b1	dll		Heodo
2022-07-01 16:27:57	80c841e53f37d81cc07b9260db8d32d8fa0ffb4dc2f848f285f975b85ca2f2c6	dll		Heodo
2022-07-01 16:17:40	cdeee226e425980291000286ebf06881bb935530478e4e6185cedea0db85892c	dll		Heodo
2022-07-01 16:00:25	e22d8732a1738af069d0c97fbe0b0d1e7763081c52fab3463a44645a896b658e	dll		Heodo
2022-07-01 15:47:05	dc5d3d70bba0091a931420358a40a06694b4058a46799aaa3b6385f721a4979e	dll		Heodo