URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2025-09-30 19:11:21	154.221.131.115		Not listed	AS134175 SH2206-AP	HK	yes
2025-07-04 19:36:44	223.109.81.159		Not listed	AS56046 CMNET-Jiangsu-AP	CN	no
2025-07-04 19:36:45	223.109.81.160		Not listed	AS56046 CMNET-Jiangsu-AP	CN	no
2025-07-04 19:36:46	223.109.81.161		Not listed	AS56046 CMNET-Jiangsu-AP	CN	no
2025-07-04 19:36:45	223.109.81.162		Not listed	AS56046 CMNET-Jiangsu-AP	CN	no
2020-11-19 14:12:17	27.124.12.113		SBL668364	AS152194 CTGSERVERLIMITED-AS-AP	HK	no
2020-10-22 20:12:13	154.196.140.147		Not listed	AS17497 LGHL-AS-AP	SC	no

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2020-10-22 20:12:13	https://kf.ocbc.cc/install/4iI/	Offline	doc emotet epoch2 heodo	Cryptolaemus1

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2020-11-27 21:06:53	ceeab6b80ae339f94184a0fed1a1748e68c9ef062c3f00a20b78a0b5ea1eedcd	unknown
2020-10-22 21:00:26	838408d31e494e72b257feeec73407a2f778e6ecc47754ae16af0290515dc9fd	doc		Heodo
2020-10-22 20:38:42	babd6a080477d8f6f7854fd6b50a264c6e6fd601388dfacb28ef224a8b08b8c4	doc		Heodo
2020-10-22 20:12:13	143a635255333363ae3017af09505f23784d4fe518164c2c25d97f8b8ec77e4a	doc		Heodo