URLhaus Database
Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).
Database Entry
IP addresses
The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.
| Firstseen (UTC) | IP address | Hostname | SBL | ASN | Country | Active? |
|---|---|---|---|---|---|---|
| 2025-04-28 13:30:31 | 109.95.159.32 | web03-s199.ewh.eu1.dhosting.com | Not listed | AS48896 DHOSTING-AS |  PL | yes |
| 2021-03-15 13:24:06 | 109.95.158.2 | web03-s209.ewh.eu1.dhosting.com | Not listed | AS48896 DHOSTING-AS | PL | no |
Malware URLs
The table below shows all malware URLs that are associated with this particular host.
| Dateadded (UTC) | URL | Status | Tags | Reporter |
|---|---|---|---|---|
| 2021-03-15 13:24:06 | https://hostelkielce.com/vn.bin | Offline | exe ModiLoader  |  vxvault |
The table below shows recent payloads delivery by this host.
| Firstseen (UTC) | SHA256 hash | File type | Bazaar | Signature |
|---|---|---|---|---|
| 2021-03-22 14:53:56 | 4d71bbe32ad8828d3ed66fb0ea352086181390391bab0960298fad620b61eee7 | exe | ModiLoader | |
| 2021-03-18 16:47:09 | a1b2f18b48cbae1df244f074c9a7f1ccfd369aeb981c6a4964b36d5d9e0c487c | exe | ModiLoader | |
| 2021-03-16 07:58:59 | f146a78fcb661e52a39f47dd059bc559bb055bb862ae134db67d0d7fde07e215 | exe | ||
| 2021-03-15 13:24:06 | 57e066f210a5d85717e132895bb1361c5ca30a3af0a069232a0868a7ad0a32ab | exe |