URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2023-01-07 00:51:30	91.227.16.6	pxe1.host-food.ru	Not listed	AS207027 Eximius-AS	RU	yes
2022-11-30 18:19:06	91.227.16.12	srv12.host-food.ru	Not listed	AS207027 Eximius-AS	RU	no

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2022-12-23 04:15:15	http://h166135.srv12.test-hf.su/3.exe	Offline	exe	abuse_ch
2022-12-06 14:12:05	http://h166135.srv12.test-hf.su/9.exe	Offline	cutwail exe	abuse_ch
2022-12-04 05:16:11	http://h166135.srv12.test-hf.su/6.exe	Offline	32 exe	zbetcheckin
2022-12-04 05:16:11	http://h166135.srv12.test-hf.su/1.exe	Offline	32 cutwail exe	zbetcheckin
2022-12-04 05:15:12	http://h166135.srv12.test-hf.su/8.exe	Offline	ArkeiStealer exe	zbetcheckin
2022-11-30 18:19:06	http://h166135.srv12.test-hf.su/7.exe	Offline	cutwail exe	abuse_ch

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2022-12-06 14:12:05	4fc12de856dbb5dc58df001bd44e75ad42e106b49ff8eee361cd000744258eb3	exe		Cutwail
2022-12-04 05:16:10	242fd0ad7d0d0277986b06b893fb15c3cc42c0539f29c7a2c766728a6666d891	exe
2022-12-04 05:16:10	a29cba8815bdc0aab28a09cc85a604d0782948c3fb95ee0e2220b1f0b9ea2954	exe		Cutwail
2022-12-04 05:15:12	73a4ca1224bc4657443596157d3ce150bcd4b6dd32217f2467818c7efea4ee43	exe		ArkeiStealer
2022-11-30 18:19:05	b20984771f38828a83e820177f49ed9bd3c1f7d4e0074c3e98fea8e9b2aee59f	exe		Cutwail