URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2021-01-20 06:45:08	162.0.209.181	business93-1.web-hosting.com	Not listed	AS22612 NAMECHEAP-NET	US	no

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2021-01-20 06:46:09	http://k-t.icu/16.exe	Offline	AgentTesla exe opendir	abuse_ch
2021-01-20 06:46:08	http://k-t.icu/ri.exe	Offline	AveMariaRAT exe opendir	abuse_ch
2021-01-20 06:46:08	http://k-t.icu/67.exe	Offline	AgentTesla exe opendir	abuse_ch
2021-01-20 06:45:08	http://k-t.icu/cj.exe	Offline	AveMariaRAT exe opendir rat	abuse_ch

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2021-01-21 17:23:08	60a17c61e904c4b15c5b6bb0a575ca3f4d57c7e68a9a8ce8af9263fda3ad8ddf	exe		AgentTesla
2021-01-20 06:46:09	043bdeb2605902253d8f2f35e312910f86b287c6c4d65560b8c3741d65aec9ff	exe		AgentTesla
2021-01-20 06:46:08	eaff959136dcb8dbb2db3429ac0ed3efe5263d99abacd5bbb05ba0f36495683c	exe		AgentTesla
2021-01-20 06:46:07	a9354f6be9a86c64e1b57ed80cf9f7321b4e986349bdc2275f63534be8ef77c9	exe		AveMariaRAT
2021-01-20 06:45:07	697a598f8ed9e8d8ca308a2472e712420d116e48db95d4a0cd69495242f47e2f	exe		AveMariaRAT