URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2020-05-27 06:18:33	45.143.139.9	invs.ru	Not listed	AS47196 Garant-Park-Internet	RU	yes
2020-05-27 06:18:33	46.148.21.36	ip-46-148-21-36.infiumhost.net	Not listed	AS50297 Infium	LT	yes

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2020-05-27 06:18:33	http://gstat.ddoborguild.com/0n1ine.exe	Offline	exe geofenced Gozi ISFB ITA ursnif	abuse_ch

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2020-05-27 14:53:46	56f3dc2826055a4783d174d4b288a929f6848ba3084b8ab11d139e0db85534aa	exe		Gozi
2020-05-27 12:00:49	582ee32ff1c8e0ea7fafcf298d5083534597ffd42b9d579581f9b6780ff639da	exe		Gozi
2020-05-27 10:49:56	cb519061fcb25330bc1482cb7a05e85bb9380491da2a1b0f8247f5feec4dea5d	exe		Gozi
2020-05-27 10:03:56	6134316639903e8ba2e7749cf564f6bf4aa39865cc50d74714732e96f09f3d60	exe		Gozi
2020-05-27 07:14:41	4ad9b2c71f0eafb891f414285257264f921c343864188c1398f68b61726f758d	exe		Gozi
2020-05-27 06:20:57	309899a737816d8291685aeb67618be893d201317399830ae4a6f7d7e9858000	exe		Gozi