URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2025-04-27 15:46:28	146.70.56.163	buc03.virtono.com	Not listed	AS9009 M247	RO	yes
2021-07-15 17:58:08	195.201.84.52	static.52.84.201.195.clients.your-server.de	Not listed	AS24940 HETZNER-AS	DE	no
2021-03-01 14:03:11	45.15.20.103		Not listed	AS9009 M247	RO	no

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2021-03-01 15:02:09	http://fusionsplicer.ro/e7ebs0.tar	Offline	Dridex	wato_dn
2021-03-01 14:03:13	https://fusionsplicer.ro/e7ebs0.tar	Offline	Dridex	stoerchl

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2021-03-02 06:39:18	3f1ada78b282636a9edbac8f7fef7fe53e2ed62b2b732aed16e9ecfcb5cc04c7	dll		Dridex
2021-03-02 06:22:05	3f1ada78b282636a9edbac8f7fef7fe53e2ed62b2b732aed16e9ecfcb5cc04c7	dll		Dridex
2021-03-01 18:48:18	9789e808a4b2da31b349f133baafbfd9e05fc78b598915bb46c492c8aeef317f	dll		Dridex
2021-03-01 18:25:56	9789e808a4b2da31b349f133baafbfd9e05fc78b598915bb46c492c8aeef317f	dll		Dridex
2021-03-01 15:14:43	dda89a15ad60d2b07f09b103acd4669fbebc743244575772614236ba4d68d9dd	dll		Dridex
2021-03-01 15:02:09	dda89a15ad60d2b07f09b103acd4669fbebc743244575772614236ba4d68d9dd	dll		Dridex
2021-03-01 14:03:07	a67dc3eeff212955f4dd24beeeba0cae8170fb57714a017edde8eecd5d19fb51	dll		Dridex