URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

Host:	gzesa.net
Domain registrar:	Xin Net
Domain registration date:	2019-08-27 02:53:54 UTC
Spamhaus DBL :	Not blocked
SURBL :	Not blocked
Quad9 :	Not blocked
AdGuard :	Not blocked
Cloudflare :	Not blocked
ProtonDNS :	Not blocked
OpenBLD :	Not blocked
DNS4EU :	Blocked
Control D HaGeZi :	Not blocked
Firstseen:	2021-11-30 21:57:08 UTC
Total malware sites :	16
Online malware sites :	0 (0%)
Offline Malware sites :	16 (100%)
A record(s) observed :	2

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2022-03-15 09:09:26	106.53.80.166		Not listed	AS45090 TENCENT-NET-AP	CN	yes
2021-11-30 21:57:10	139.199.80.238		Not listed	AS45090 TENCENT-NET-AP	CN	no

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2022-01-20 20:30:16	http://gzesa.net/wp-includes/ID3/EhsyJ2N/?i=1	Offline	doc emotet epoch4 heodo SilentBuilder	Cryptolaemus1
2022-01-20 20:30:05	http://gzesa.net/wp-includes/ID3/EhsyJ2N/	Offline	emotet epoch4 redir-doc xls	Cryptolaemus1
2022-01-17 21:33:05	http://gzesa.net/wp-includes/ID3/KW-4932/	Offline	emotet epoch5 redir-doc xls	waga_tw
2022-01-17 21:33:05	http://gzesa.net/wp-includes/ID3/KW-4932/?i=1	Offline	doc emotet epoch5 heodo	Cryptolaemus1
2022-01-14 01:24:05	http://gzesa.net/wp-includes/ID3/OJ51/	Offline	emotet epoch5 redir-doc	Cryptolaemus1
2022-01-14 01:24:05	http://gzesa.net/wp-includes/ID3/OJ51/?i=1	Offline	doc emotet epoch5 heodo	Cryptolaemus1
2022-01-12 04:00:11	http://gzesa.net/wp-includes/ID3/2133563-04/	Offline	emotet epoch5 redir-doc xls	waga_tw
2022-01-12 04:00:10	http://gzesa.net/wp-includes/ID3/2133563-04/?i=1	Offline	doc emotet epoch5 heodo	Cryptolaemus1
2021-12-24 06:01:10	http://gzesa.net/wp-includes/ID3/0ebN49GoEsK/	Offline	emotet epoch4 redir-doc xls	waga_tw
2021-12-08 07:31:21	http://gzesa.net/wp-includes/ID3/1h78Vjf/	Offline	dll emotet epoch5 heodo	sugimu_sec
2021-12-04 01:50:07	http://gzesa.net/wp-includes/ID3/vkqUQknP1Efohc/	Offline	doc emotet epoch4 heodo	Cryptolaemus1
2021-12-01 09:39:09	http://gzesa.net/wp-includes/ID3/31P9pZ/	Offline	emotet epoch4 redir-appinstaller	sugimu_sec
2021-12-01 07:28:17	http://gzesa.net/wp-includes/ID3/hC2c/	Offline	emotet epoch4 redir-appinstaller	sugimu_sec
2021-12-01 05:24:10	http://gzesa.net/wp-includes/ID3/HrUt1vISyzc/	Offline	emotet epoch4 redir-appinstaller	Cryptolaemus1
2021-12-01 01:53:09	http://gzesa.net/wp-includes/ID3/hC2c	Offline	emotet epoch4 redir-appinstaller	waga_tw
2021-11-30 21:57:10	http://gzesa.net/wp-includes/ID3/HrUt1vISyzc	Offline	emotet epoch4 redir-appinstaller	waga_tw

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2022-01-21 07:10:36	6407591df6ce61f946e24715faa6fba1b1f3221e2baf22f6c4f5a64f1ea98eb5	xls		Heodo
2022-01-21 06:55:40	aba8e5024172cc0cd240eda2c379e91825cb922f0c5d56d82a560dcb15eef097	xls		Heodo
2022-01-21 06:28:14	b8fef9073b247386d53e1eba4723994cf6300b257f2b637cb1eccead6b68904c	xls		Heodo
2022-01-21 06:14:07	7efacaa6dacfe6bf20d27faaf86184458461e64165c615cede70b42cf913f8ae	xls		SilentBuilder
2022-01-21 05:58:45	fc79dd33ef2208cbe871b54938ff2ad295a34cb9a720e4995853dfed5761db18	xls		SilentBuilder
2022-01-21 05:47:50	29111d8e5e8306e76660db292e7232ab39e901955014eede21e912c931a09b5f	xls		Heodo
2022-01-21 05:35:48	d1f5ad731dbf6263cbcee95b142ffb0ebc190205ae58d4a4948bb3e5ad09e4bb	xls		SilentBuilder
2022-01-21 05:18:59	c3496d8e7d2ffbb343cb44911bd859ceb08cbac8eb09ebfc58ce6cb1208f2d8e	xls		Heodo
2022-01-21 04:58:20	6027b0c0ed3191c277bd14f9bfca0e7110c5b306dba6bdc3e5bf123d0b31e6ae	xls		Heodo
2022-01-21 04:42:12	e06d794800a6c8e29eaee2ec0e2ccd9f60b00c7d6c9b4a80ce605a4c156f9982	xls		Heodo
2022-01-21 04:20:57	6232ba47b182fc60d16bf5b9d41f5dc614f2f348e83414c533df7ccbfb940885	xls		Heodo
2022-01-21 04:11:31	fe0ea8701f0d1d1b08de951b55324c38441ca10539fdac0274a95e293448f8f3	xls		Heodo
2022-01-21 03:55:23	8b24ef9d0556c1351a46d2e0eb996b21b65638c41dc79cd5b676a79bf0d18a17	xls		Heodo
2022-01-21 03:44:09	539a3855a176457a29262e61d738250050450a8a6adb2b1e9c8961a40a6cad57	xls		Heodo
2022-01-21 03:22:07	3b8dc8f1f75a66d545d45ee9f4160ea99cff4e8cc3f5b265ea27736a3eabf381	xls		Heodo
2022-01-21 03:06:37	2847438e4b48ee5f630b8d0a3d5361bf4071aa308d8999a69cba995fa548add5	xls		SilentBuilder
2022-01-21 02:51:21	ccd9c6eef79a18615ba690a35d8a2f238ef0d6cf1e715536299b42f9e67357d6	xls		Heodo
2022-01-21 02:35:55	afb4a25125020d107aa065816ff0c80dfbc85d700a654a29b73aa8143c2e909f	xls		Heodo
2022-01-21 02:21:29	2cb043937c5838c3f91d3955127cc444ff420b74448d38395ab177b8369753d0	xls		Heodo
2022-01-21 01:51:59	c853e3e650463ca03b11d37a51d45c21e90abb85fe410073c435eba0d168d28c	xls		Heodo
2022-01-21 01:43:25	3accfd2337522a6c68a1018979e3ac6603237e13aff0b962ae093662129d8609	xls		SilentBuilder
2022-01-21 01:23:32	4520398e8aeabb1aed9cd4899a2ac014545d9ad9383959288cf2470f9c1c4731	xls		Heodo
2022-01-21 01:01:50	bf377a8c8ae5170949a1ea2d2f8fb6d63a24839276a2fd63bc2a4525f1839a59	xls		Heodo
2022-01-21 00:54:11	e57baf9289180802e131633ce599fd55a0a67db3423c45d62f4a88fbf94a0874	xls		Heodo
2022-01-21 00:30:46	01bab18ffb7052e8d67dc6447267ec775667a721592e609cf62dd08649d7a807	xls		SilentBuilder
2022-01-21 00:19:12	9296f02a362c27b1e3a3b4119ede64ea52b6c0430fc70517e5146730c23c987d	xls		Heodo
2022-01-21 00:02:56	2d259bd946fb388d1a7d75d28ba591aca3377e0ca8b49e0add414fe82b76f483	xls		SilentBuilder
2022-01-20 23:50:41	88c13197081731462e05ef64b1c9abbdc1b85e0e573437506270137fb7b735d8	xls		Heodo
2022-01-20 23:40:54	2181997083632b17484474d7152e18c8a65175b823c871b164d15d2e20a8ae16	xls		SilentBuilder
2022-01-20 23:26:29	345965e8a8dc6b64c4fad5c48851aa3a2efb483d409eb259fb2ceaaec1f01dbc	xls		Heodo
2022-01-20 23:04:00	536582463c4d7bc11c931e61b72316d539e0b4ed677451ec3ab8942f6a02a040	xls		Heodo
2022-01-20 22:44:04	514af468cf8a54d3ba4fd08208de3119721d9a9b5e4d2c96373add4d3dd7688d	xls		Heodo
2022-01-20 22:31:57	afc76f4aa05482102ea34e10b3d2397db55857510ce6ae3dcfe05e29cc92bde3	xls		Heodo
2022-01-20 22:24:22	cc087101e48ffeece56deba54e6da814a6d35e371396b07cc4e10b121aac9907	xls		Heodo
2022-01-20 22:00:40	48fee052f0fa5361ddc892d4768321a00e5c80adabc60654488ea8fc1ffa135f	xls		Heodo
2022-01-20 21:40:24	0450c09d5fe3db81273bb016f057664f805ea0dde2c1c53ad512324c191ac2a5	xls		Heodo
2022-01-20 21:26:41	6f95d343a882d6e800379be638a48804dfc956537ffcc06361e1f57fa2938808	xls		Heodo
2022-01-20 21:15:42	51dc452edd7c975ac8f632ad888d6cada4233c19aa061416076abbdb2ac596b4	xls		Heodo
2022-01-20 21:03:42	ab4456f73cd0d49bd6c2dc5553a33ff128bc765cb07cd47f8e0619d01735f966	xls		Heodo
2022-01-20 20:45:17	caa57a0d7208775ee50b80b88384a83804e8b132229162b88db9a3a57abb7acb	xls		Heodo
2022-01-20 20:30:16	06be4ce3aeae146a062b983ce21dd42b08cba908a69958729e758bc41836735c	xls		SilentBuilder
2022-01-20 20:30:05	d8a4ed5bce8915454a929226a37ab612dfd19cec733e6c0fb916a2499b40bfc9	html
2022-01-18 06:35:52	e95a1d9f8651d516e59ddffadc5fd94a499b888077d6cc60ee5cc1b95c1f91e7	xlsm		Heodo
2022-01-18 06:02:27	08ed773eaf043bb76b2576c9376b8715da6d2677f07277f709e74d4844343b7c	xlsm		Heodo
2022-01-18 05:46:10	c837ba3be459d30d75ba53677884651f8ea4be085bfc4fd3bd3d87a85c4f2136	xlsm		Heodo
2022-01-18 05:35:04	8a1f1920da77f2aa02e0d38a92cc3f9901781484353db80e8940a750d673f023	xlsm		Heodo
2022-01-18 05:14:19	c376ffe4c231464c947bc77a323936d8eb64d85bcd1ddcd33bcc161dae53ef15	xlsm		Heodo
2022-01-18 05:04:17	64d41354ecd7f297389d824c38b8b00241322769011feb0c864269145fd8f174	xlsm		Heodo
2022-01-18 04:39:37	1d95f9d613b01b2dcf2ff10254cf77e3210a07f1a209855de18043c161520191	xlsm		Heodo
2022-01-18 04:03:51	ccbc039cf33ad86b9287d5ddeb42977c7b30bdf9e8a728478f7be2f0231c9310	xlsm		Heodo
2022-01-18 03:43:20	865dc6708076f891bd39b67e2f62ac875029eb002601a31442dcd0280c0c829f	xlsm		Heodo
2022-01-18 03:30:34	0228ceafa8f9fb29813b9462d9aee85f346c43440aabab248ee3a28283eb4f6f	xlsm		Heodo
2022-01-18 03:17:18	58a1033b4773f07ae0f7257590bf372fde51e9bc60298c483a5bf53a93210433	xlsm		Heodo
2022-01-18 02:57:14	976872f868b49d98d5e487b42d9bce61f8b05d610fb794ccacbe1ca4274d71cd	xlsm		Heodo
2022-01-18 02:50:10	071b56a5371a11d25784a06fa995cbf3127cafc79a1da89ed889d7d35b235f46	xlsm		Heodo
2022-01-18 02:15:21	954cce122bbc5f2db9b047be265ecb1c8dbbe04b37eaf5b2f738423610df2d4a	xlsm		Heodo
2022-01-18 02:03:08	72c3f7215a023270169a1f1a078c7df9714bdb4ab297fe3bfde6e13fbcb08c68	xlsm		Heodo
2022-01-18 01:43:14	bca263286c21f2647b4f0885a0848164685ab40aa0d758e94eb8d774d940c69d	xlsm		Heodo
2022-01-18 01:31:03	b977c5112c9836972623051077502437f1a49a9b8c0ae004c54d0a5685f5b974	xlsm		Heodo
2022-01-18 01:22:28	7a36780755f25695430762b1ae5759a6b789c298db856370cd0b6fd0f857f835	xlsm		Heodo
2022-01-18 01:07:15	e961e46fe0000505f4534e036a9d1d2a59823cf644438a2733ab659e9c22988b	xlsm		Heodo
2022-01-18 00:42:16	64b618a8cd97c14013cdb8352e6959b5f4097adfa9986a19e4a916141cccc9ad	xlsm		Heodo
2022-01-18 00:24:58	875b1c9e36a5cf567317565b0b54324da0aac7ca5c69f0c688853731da4082fe	xlsm		Heodo
2022-01-17 23:58:46	053bb9b9096198d542ba99d4aa0148e9af3797c17d2b874f406bf9d35749d809	xlsm		Heodo
2022-01-17 23:46:31	6f547f1af075434c1f8fd54fb78b5a4f15d49e4a38e86d6e129d88c3e83ea230	xlsm		Heodo
2022-01-17 23:31:52	3205e9241e6f23942fd5b8ff4babdf561cd0022a6d42a800075046bb9e627eb8	xlsm		Heodo
2022-01-17 23:18:48	b74ebda344b21397a7dda793d725fc98a04efae5d4cc51c8c8b6f9c253bdcb83	xlsm		Heodo
2022-01-17 22:53:40	47c80c975818ab9bd09449d2130bcfb94eeab3b0aaaa784f5c2b56cc3d32c796	xlsm		Heodo
2022-01-17 22:35:56	1227b6464953ca3a4307804a94c248736f40446a42121d3e0ceb52fc63629f8a	xlsm		Heodo
2022-01-17 22:24:25	d184b3138413ca1b9e64edc98add0851bdeec2158f3a247532593deb9cbfc808	xlsm		Heodo
2022-01-17 22:12:02	ffb2a0ff4ab817787bae6e304ecc561e2e839edd4d20194227a194e6e8bb7b0f	xlsm		Heodo
2022-01-17 21:56:20	2350f0180119d36193a0ff0d35370865e389ebf2b910fbfa8419c7a2258a9356	xlsm		Heodo
2022-01-17 21:33:05	9994c128dac8fef0f5b7a94e7379a6eb0f2b3ab28cf8c641f2fecfc11a1100a9	xlsm		Heodo
2022-01-17 21:33:05	eddaea0531893f38fef252cb8783b618683b157084c049f9deaf822420f582e5	html
2022-01-15 01:31:35	de54a7c99135db230ba151e513f7813ccca74b08201d7592958e82c51b152386	xlsm		Heodo
2022-01-15 01:16:13	b8121edc6cc2e93b9a7832beca7e11a32f3c0b8214816c8276a2d2eeec251050	xlsm		Heodo
2022-01-15 00:52:40	1f2fb274efe18ae6707db44fd5e92e99c9da494530658002e2443435536ad260	xlsm		Heodo
2022-01-15 00:33:22	69dd17d667b01b8c139033215bad8690a13db67dcab99d323edee2a21ad0a44e	xlsm		Heodo
2022-01-15 00:19:23	c58ec0360d977c3351cf691b6f778bff30e6392de98f919995bbfa8b77712bdb	xlsm		Heodo
2022-01-14 23:50:31	7968b7e44f8390c379b215df6dc2409c6fead9c38927f667442a183da96df234	xlsm		Heodo
2022-01-14 23:24:20	23d904c32148793e80d050809ec6989aa4733e705e1aa03df256c3fa6ae218cf	xlsm		Heodo
2022-01-14 23:09:45	2c1629903649cbcf3b885c468c648e7b9caad9bce1bad13edf832b78d8e98d96	xlsm		Heodo
2022-01-14 23:02:59	2a5d979303bbfb1841259d7d749dfbd18ede67591c12a1bf6226ee347e5987a7	xlsm		Heodo
2022-01-14 22:48:06	269e9c81c482255515158bebf6c871afb18b879ac13cfcd7e9a22a6e6476423f	xlsm		Heodo
2022-01-14 22:22:17	d9d89cefabc087af2be25fadd162ff8d73bc3cc83ed65bfa30cc860af14db3c8	xlsm		Heodo
2022-01-14 22:10:35	1f9d9fca72abbfae3dc8f70790c4d8ee3916adc5c68ab73c3d2cdd1fa38198b4	xlsm		Heodo
2022-01-14 21:33:40	a51724da5a2c220ccb551df3d43ba4004b8231ff7848bc4058daf8477c56f75e	xlsm		Heodo
2022-01-14 21:26:06	2819520aee64e6800af25eca5fa2aa0bc926fc6dd13200b425c0a686d95db027	xlsm		Heodo
2022-01-14 21:10:58	013f28c036fa5af595b6c61d98cb6dc88cb8045194ef50facb59d481041c23cd	xlsm		Heodo
2022-01-14 20:40:20	21279987ba4135e6afcbc5527f9c26b7d4e3aec26aa1e1863d2e144edd7f7730	xlsm		Heodo
2022-01-14 20:22:54	1945d61931cc7e9819244230ab70575eb1cebf7348d804e518182aecd018c76a	xlsm		Heodo
2022-01-14 20:04:54	6c0e05648d4f157e4d9aaeaba27c463a21b4039a0a3ed03209a6c711b556e35c	xlsm
2022-01-14 19:45:29	87a33eb014251fbd3e80d9dce2bf789e0c1b579d59554f4efbdd3f6d78a6e57f	xlsm		Heodo
2022-01-14 19:31:03	21961b0d16c7d2561ef0c3d8a055eee86e90688f4a6fbe27c7f64c61096d0aec	xlsm		Heodo
2022-01-14 19:12:54	c822efa6c4fed299c0bd7794b8f9a4e193703f2d22f78a795dbebc4748dbd4b1	xlsm
2022-01-14 18:58:26	01e7bf755c02b2a01e54ba0c464ce80a6e64a404a541e9fd46ac00fd1d3b22f2	xlsm		Heodo
2022-01-14 18:44:46	4fca1c54e08fdaa16e2a0697f33e798e9dcacde746cc035fe595bdbf1822b2f1	xlsm		Heodo
2022-01-14 18:25:27	89be0892e2374d1d0423930f73ad31cda4da82ee29970a5fef0a996357609051	xlsm		Heodo
2022-01-14 18:15:19	ed0448141caba757e10c045d97e8593777ba7c60b8871b5871622b2b80ad1519	xlsm		Heodo
2022-01-14 17:59:33	df06e51b72166281110f90f19e518fd3a11af0a1ced6a279c8c16277ad38e62d	xlsm