URLhaus Database
Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).
Database Entry
| Host: | h170420.srv22.test-hf.su |
|---|---|
| Domain registrar: | Webnames.ru  |
| Domain registration date: | 2014-10-22 05:41:17 UTC |
| Spamhaus DBL : | Not blocked |
| SURBL : | Not blocked |
| Quad9 : | Not blocked |
| AdGuard : | Not blocked |
| Cloudflare : | Blocked |
| ProtonDNS : | Not blocked |
| OpenBLD : | Not blocked |
| DNS4EU : | Blocked |
| Control D HaGeZi : | Not blocked |
| Firstseen: | 2023-08-22 10:54:05 UTC |
| Total malware sites : | 3 |
| Online malware sites : | 0 (0%) |
| Offline Malware sites : | 3 (100%) |
| A record(s) observed : | 2 |
IP addresses
The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.
| Firstseen (UTC) | IP address | Hostname | SBL | ASN | Country | Active? |
|---|---|---|---|---|---|---|
| 2023-10-03 01:35:45 | 91.227.16.6 | pxe1.host-food.ru | Not listed | AS207027 Eximius-AS | RU | yes |
| 2023-08-22 10:54:06 | 91.227.16.22 | srv22.host-food.ru | Not listed | AS207027 Eximius-AS | RU | no |
Malware URLs
The table below shows all malware URLs that are associated with this particular host.
| Dateadded (UTC) | URL | Status | Tags | Reporter |
|---|---|---|---|---|
| 2023-08-22 10:54:10 | http://h170420.srv22.test-hf.su/163.exe | Offline | dropped-by-SmokeLoader povertystealer |  Casperinous |
| 2023-08-22 10:54:07 | http://h170420.srv22.test-hf.su/164.exe | Offline | dropped-by-SmokeLoader LummaStealer | Casperinous |
| 2023-08-22 10:54:06 | http://h170420.srv22.test-hf.su/calc.exe | Offline | dropped-by-SmokeLoader Stealc | Casperinous |
The table below shows recent payloads delivery by this host.
| Firstseen (UTC) | SHA256 hash | File type | Bazaar | Signature |
|---|---|---|---|---|
| 2023-08-29 19:42:15 | 3653caabf3a0aa1b2ec0cb9fbdcbe5fd4d28a5d6794d8ff307b44ee3efc3d79d | exe | Stealc | |
| 2023-08-27 09:24:29 | a05c09738fbbb96b5d5846737d8bbff39b6ff4bf4d0efa51e80d34b555d7ee97 | exe | Stealc | |
| 2023-08-26 10:13:29 | 4d95c08bbac739d7c01fca4d179abe72306aaa06959fce76ad18754b61ba0846 | exe | Stealc | |
| 2023-08-25 09:45:07 | 1b0da8603f31103a5d90152c983ddd534e128abed1901fe5debb660c0bb6ecce | exe | Stealc | |
| 2023-08-24 20:19:52 | bff8580b564b68ff541a2f597715b69a2bd9373529eb6278c2e6fcf321fb50bc | exe | Stealc | |
| 2023-08-23 06:01:09 | 508636b6c60753fad23295328180bf3b2c003437fdabc24a84f6d283fd3d96fa | exe | Stealc | |
| 2023-08-22 10:54:10 | 1c06a90840409f4635e8f9d959f482ed40379571595e2546926429f974998d21 | exe | PovertyStealer | |
| 2023-08-22 10:54:07 | 545462d50f459ec12cc489c7b2f9ffca485100c85d1d21e8d8987a0a4857563c | exe | LummaStealer | |
| 2023-08-22 10:54:06 | 8c3379cd31478527d1d0405a836a59220a3cdd3135661b40d30e1ed509c34993 | exe | Stealc |