URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2025-11-18 14:49:50	52.223.13.41	a74e89cf4458da039.awsglobalaccelerator.com	Not listed	AS16509 AMAZON-02	US	yes
2020-08-10 11:01:15	119.81.212.98	62.d4.5177.ip4.static.sl-reverse.com	Not listed	AS36351 SOFTLAYER	SG	no

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2020-08-10 11:01:15	http://laceandbutton.com/shop/parts_service/	Offline	doc emotet epoch2 heodo	spamhaus

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2020-08-10 14:33:29	f8f7b8382a2b523434f8826e74bd13ac94a03c98be63a7ae9154bbe3a3295c69	doc		Heodo
2020-08-10 14:05:33	4ce94f29979a4a4a4c9bc4f2bf228fb0be213bf34298fea52bf3bb82fe03118c	doc		Heodo
2020-08-10 13:47:42	9e9dcc63032c40001dbddb5bd18a2b6fe5605bb069cc340d150b9a779f2ae273	doc		Heodo
2020-08-10 13:19:13	8bfc9f0131ca6f43abc2eac3a5e2345362e5c80a1d7f5ecf729811990863a1c4	doc		Heodo
2020-08-10 12:56:56	149576ef5ef94316d4e0db4ce478cd4866a0293878a5d8070dc4bbe6d86050b7	doc		Heodo
2020-08-10 12:37:13	c5a9dbb440705a6a2b8b1b672176e61075d8b4b8261b9a395920e2cafd206b65	doc		Heodo
2020-08-10 12:21:00	38aec6035b9dc07a41f0b344d8a84b416a54ac964178c2a9a23e139287ffceb8	doc		Heodo
2020-08-10 11:34:24	f0f54c085e6d5988f5a9e875aacabe15841b6de0f70e4cdfd5ae1ae23ff46bed	doc		Heodo
2020-08-10 11:01:15	5358ef29b9e1c832a55bd66f19aa10501a806e97c4967f7eb9843c5f7c524c06	doc		Heodo