URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2025-04-27 12:13:52	93.188.2.53	webfront3.webcluster.loopia.se	Not listed	AS39570 LOOPIA	SE	yes
2020-07-15 07:16:56	173.249.24.74	srv.narodniteam.com	Not listed	AS51167 CONTABO	FR	no

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2020-07-15 09:10:06	http://kupijeftino.rs/s/SWIFT.exe	Offline	exe RemcosRAT	zbetcheckin
2020-07-15 09:10:04	http://kupijeftino.rs/s/PO.exe	Offline	exe RemcosRAT	zbetcheckin
2020-07-15 08:26:02	http://kupijeftino.rs/s/ORDER.exe	Offline	exe NanoCore	zbetcheckin
2020-07-15 08:22:03	http://kupijeftino.rs/s/ORDERS.exe	Offline	exe RemcosRAT	zbetcheckin
2020-07-15 07:16:56	http://kupijeftino.rs/s/ORDER07142020.exe	Offline	exe RemcosRAT	gorimpthon

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2020-07-15 09:10:06	1d510653c1ea9f9a519c53d92067ab27ee434f8e5c34b980f6a236f4e02dba22	exe		RemcosRAT
2020-07-15 09:10:04	356c197426a3bdabccf7b10ece0a425571b55bbeb7e09e3121b6ff6b7c2e253a	exe		RemcosRAT
2020-07-15 08:26:02	5106eff2035cae4bc844f175750857ecffe095b70f7872ddd212bedce7776e80	exe		NanoCore
2020-07-15 08:22:03	8c59bc29addb6c7cd78946b0f449b39ba663b0311d80c1a55b54742e7facb8af	exe		RemcosRAT
2020-07-15 07:16:56	01de61b8b14bb1231ac14968c89b304afa74376e70ce29c7da92259a8a702b60	exe		RemcosRAT