URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2020-09-16 18:00:35	164.68.109.228	ip-228-109-68-164.static.contabo.net	Not listed	AS51167 CONTABO	FR	no

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2020-09-16 18:00:35	https://lggpm.live/cgi-bin/Yq/	Offline	emotet epoch1 exe heodo	Cryptolaemus1

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2020-09-16 20:50:24	a08d313886929d1efb96d55751a2ab1a9a21b40a089b643b08eb6f9fb34855b1	exe		Heodo
2020-09-16 20:18:04	fd5de4cc19b310e2785139fb223d2dbf6d79d0d36a8dc512a0e696615ae3d4b8	exe		Heodo
2020-09-16 20:12:01	fa5458a8dee9ef3439f8d0ca9edd8a107ffabb87ac3498ddb44e9229ee5c28fe	exe		Heodo
2020-09-16 19:47:11	68e41def7665f009a28543d324274cbc46fa581fe39d937b72cca145cc32bee8	exe		Heodo
2020-09-16 19:18:04	ff725cfa04d7d0b903d3fa6d6c49da0590b6fb458c85c3159f15ae64753f56d7	exe		Heodo
2020-09-16 19:05:16	a05eee272d05d68bd6ef11caec57fc6d6ca7e94cfda09671819d882f1a06d44f	exe		Heodo
2020-09-16 18:52:07	06e7eb13939350431cb5b26825f186e6b248e5825a34a08f9ea6a9bb3e8ab77b	exe		Heodo
2020-09-16 18:00:35	c7af60898d2b5fbffedddc798bcdde7c0b848b309bc173986a2ab909b015499d	exe		Heodo