URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2021-01-27 14:22:23	198.54.114.131	server188-1.web-hosting.com	Not listed	AS22612 NAMECHEAP-NET	US	yes

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2021-01-27 21:03:03	http://kmschoolsystems.net/lpd0w.zip	Offline	Dridex	Cryptolaemus1
2021-01-27 14:22:23	http://kmschoolsystems.net/lzpd0w.zip	Offline	Dridex	stoerchl

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2021-01-28 15:45:50	ff0efdad65d67bb34986f4be712f63ebb994dfa2fbec699a5ee2693688be6463	dll		Dridex
2021-01-28 06:37:55	834b8d8260559279876705f391670c007ee66014a2d8107abbc03abed330495e	dll		Dridex
2021-01-27 20:54:20	b6669b0677186d99b92663c86ac5c035884271e4fa76aaa9fa054dcc3d13969c	dll		Dridex
2021-01-27 18:29:12	c7f7daea8aa81d8ca8978ce28ab59ac655c141e871e09093afef3ee94a8634a7	dll		Dridex
2021-01-27 17:11:40	d22ad6672baa9d1947a2fb59d4da6ad94dd1ffca720fa060d84ea6d2dbf7a964	dll		Dridex
2021-01-27 16:24:26	e58605284b9af2bfe1f5d32ffeb2a93d6e610001ed43fe6db62e8668254d1061	dll		Dridex
2021-01-27 15:18:55	b8441a4155e9c4426686150fb40c9b5d1d459ab4f0725a8c08e9e16276530d4d	dll		Dridex
2021-01-27 14:22:22	656e8cfb9d183adf792ed933c5c177190f10064cbff62090977f2174cce9df0d	dll		Dridex