URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2020-11-02 14:44:59	52.231.166.55		Not listed	AS8075 MICROSOFT-CORP-MSN-AS-BLOCK	KR	no
2020-11-01 22:57:02	52.231.166.73		Not listed	AS8075 MICROSOFT-CORP-MSN-AS-BLOCK	KR	no
2020-09-21 15:46:45	52.231.154.57		Not listed	AS8075 MICROSOFT-CORP-MSN-AS-BLOCK	KR	no
2020-09-16 08:17:24	52.231.154.75		Not listed	AS8075 MICROSOFT-CORP-MSN-AS-BLOCK	KR	no
2020-09-14 23:41:05	52.231.176.124		Not listed	AS8075 MICROSOFT-CORP-MSN-AS-BLOCK	KR	no

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2020-09-21 14:19:07	http://injazjordan.com/moodle/Vh/	Offline	emotet epoch1 exe heodo	Cryptolaemus1
2020-09-14 23:41:05	http://injazjordan.com/moodle/NWgrYEp0/	Offline	emotet epoch3 exe heodo	Cryptolaemus1

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2020-09-21 14:19:07	d72195442dc5db3ce22e970a33db3c5e42f371d5d7bf5d851669a53a99e83cce	exe		Heodo
2020-09-15 04:32:38	6ff52e0eb98a807f5b09fdeae2d12a9cd877bedb9b4c4d734c8939ee15a1acb0	exe		Heodo
2020-09-15 00:13:51	53661760173c704efec6cfb8c028c7ac2b3c587569a45ff94f2e83d17d90087f	exe		Heodo
2020-09-14 23:41:05	ae0626ca023c33c0119c973549fbf67d659c6630ec06cc91f72f4952ce9bdfec	exe		Heodo