URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2021-01-12 07:05:44	192.210.214.178	192-210-214-178-host.colocrossing.com	Not listed	AS36352 AS-COLOCROSSING	US	no

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2021-01-13 12:17:07	http://globalbusinessserverfiletransferprotocol...	Offline	AgentTesla	cocaman
2021-01-12 07:05:44	http://globalbusinessserverfiletransferprotocol...	Offline	AgentTesla exe	abuse_ch

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2021-01-13 12:17:06	3311cea59262b019a69fb72b72a36fc8e55d48a0f14f853b3a52fc8740542e99	exe		AgentTesla
2021-01-12 19:29:17	a49e2eefab8ef402912db68d3d019be8cff2a7115f376048cbece5002003126e	exe		AgentTesla
2021-01-12 07:05:43	8a9d9e94217e06ea9f3c205b1722f76cbe9c670daee30f275f35c1fa21df13e5	exe		AgentTesla