URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2025-04-28 15:24:42	104.18.0.109		Not listed	AS13335 CLOUDFLARENET	n/a	yes
2025-04-28 15:24:42	104.18.1.109		Not listed	AS13335 CLOUDFLARENET	n/a	yes
2020-03-02 07:18:49	79.98.25.1	parked.serveriai.lt	Not listed	AS212531 Interneto-vizija	LT	no
2019-09-20 10:37:10	79.98.28.28	ieva.serveriai.lt	Not listed	AS212531 Interneto-vizija	LT	no

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2019-09-20 10:37:10	http://ic24.lt/2c.jpg	Offline	Ransomware Shade Troldesh	JAMESWT_MHT

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2020-01-09 08:03:57	9ebaa5bf1a8fbf9d4a78dac1005c3754e15d90859b63c8ad14b065cb819c3819	exe
2019-12-31 10:09:25	5862c5aa3896ac6a88ff2c48b7502750aaad1ebf4399cf8179c2e6810eb7cec4	exe
2019-12-27 16:33:02	9ff241dfba95d5064f7c51ab3aa701099a265e08a2f8904b783122108adf8b27	exe
2019-12-11 17:23:23	1151bca7e022f47a61a675fe75b86f81a585b9e1b4b6f8daa07bde8304507cee	exe
2019-12-04 15:54:01	b3af1b38e5c4fb00a0197f615e62eb6934d7ae4fb7c3ee5de5259d66605e254f	exe
2019-11-28 08:34:30	0e578729603ca31fec5ec091ab67b4940b1cf37631613a8cc742db445b5389c0	exe
2019-09-20 10:37:10	b7d5c66725810c90c16eac28adfed02a40ea845d38f7a2ff2d6020c1092f21b7	exe		Ransomware.Troldesh