URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

Host:	lavacolla.com
Domain registrar:	Key-Systems
Domain registration date:	2005-10-07 07:22:05 UTC
Spamhaus DBL :	Not blocked
SURBL :	Not blocked
Quad9 :	Not blocked
AdGuard :	Not blocked
Cloudflare :	Not blocked
ProtonDNS :	Not blocked
OpenBLD :	Not blocked
DNS4EU :	Not blocked
Control D HaGeZi :	Not blocked
Firstseen:	2023-03-02 11:02:09 UTC
Total malware sites :	7
Online malware sites :	0 (0%)
Offline Malware sites :	7 (100%)
A record(s) observed :	1

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2023-03-02 11:02:16	164.138.209.225	xaspe2.cyberneticos.net	Not listed	AS198968 CYBERNETICOS	ES	yes

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2023-10-09 14:49:05	http://lavacolla.com/centro/index.php	Offline	geofenced Gozi ISFB ITA redir-302 ursnif zip	abuse_ch
2023-10-09 14:02:04	http://lavacolla.com/codice/Documenti.zip	Offline	agenziaentrate geo Gozi ISFB ITA ursnif	JAMESWT_MHT
2023-03-14 19:00:38	https://lavacolla.com/connect/	Offline	250255 7710 geofenced Gozi ISFB ITA redir-302 ursnif	abuse_ch
2023-03-14 19:00:13	https://lavacolla.com/agenzia/	Offline	250255 7710 geofenced Gozi ISFB ITA redir-302 ursnif	abuse_ch
2023-03-14 18:59:56	https://lavacolla.com/scarica/	Offline	250255 7710 geofenced Gozi ISFB ITA redir-302 ursnif	abuse_ch
2023-03-02 12:38:09	http://lavacolla.com/impresa/Agenzia_Entrate.zip	Offline	agenziaentrate BIG Gozi ITA malware stealer	JAMESWT_MHT
2023-03-02 11:02:16	http://lavacolla.com/connect/index.php	Offline	agenziaentrate geofenced Gozi ITA redir-302 SMB ursnif	JAMESWT_MHT

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2023-10-09 20:11:38	e8bd732660ca5e1ad735a7a936d5957b0ab398c4622d8920ec772d694129740b	zip		Gozi
2023-10-09 14:02:04	ae65eeb24fc4bf25d3efe61b21f99cace992d07a4ad29112715da412019b3dd2	zip		Gozi
2023-03-02 13:40:29	f52c313277246ccd81420797967aff0a7353fe0f6badc77817e842120072efbd	zip		Gozi
2023-03-02 12:38:09	cfe6b53554aaf19a2adf3a64ac5133705d6529396de72a80f88a9446ed5ccc6f	zip		Gozi