URLhaus Database
Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).
Database Entry
IP addresses
The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.
| Firstseen (UTC) | IP address | Hostname | SBL | ASN | Country | Active? |
|---|---|---|---|---|---|---|
| 2026-02-19 17:42:45 | 188.114.96.3 | SBL690066 | AS13335 CLOUDFLARENET | n/a | yes | |
| 2026-02-19 17:42:45 | 188.114.97.3 | SBL691350 | AS13335 CLOUDFLARENET | n/a | yes | |
| 2026-03-28 13:16:47 | 104.21.30.110 | Not listed | AS13335 CLOUDFLARENET | n/a | no | |
| 2026-03-28 13:16:47 | 172.67.172.197 | Not listed | AS13335 CLOUDFLARENET | n/a | no | |
| 2026-02-17 10:39:17 | 85.239.47.252 | Not listed | AS9123 TimeWeb-AS | RU | no | |
| 2025-07-29 18:25:09 | 89.185.80.131 | 103660.ip-ptr.tech | Not listed | AS215540 GCS-AS | US | no |
| 2026-03-17 08:01:32 | 188.114.96.12 | SBL687667 | AS13335 CLOUDFLARENET | n/a | no | |
| 2026-03-17 08:01:32 | 188.114.97.12 | Not listed | AS13335 CLOUDFLARENET | n/a | no |
Malware URLs
The table below shows all malware URLs that are associated with this particular host.
| Dateadded (UTC) | URL | Status | Tags | Reporter |
|---|---|---|---|---|
| 2025-07-29 19:24:11 | http://inoveex.com/file/setup7492.pdf | Offline | MetaStealer msi | |
| 2025-07-29 18:25:09 | http://inoveex.com/files/Delay_Impact_Statement... | Offline | lnk MetaStealer |
The table below shows recent payloads delivery by this host.
| Firstseen (UTC) | SHA256 hash | File type | Bazaar | Signature |
|---|---|---|---|---|
| 2025-07-29 19:24:11 | db09f8ba6b1ec60f3e02eb61451690beedecb2ff2cf8ef9731736c22f17b32d2 | msi | MetaStealer | |
| 2025-07-29 18:25:09 | e916c8e22f9cbe3fd58afc2b228db2a07790808681bc3362061e615d14ef402c | lnk | MetaStealer |

RU