URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2021-07-12 11:30:04	62.112.195.244	salsa.tdv.hu	Not listed	AS197248 DRAVANET-AS	HU	no

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2021-07-13 22:29:06	http://lifestyledrinks.pl/wp-includes/TevTevMov...	Offline	32 exe njRAT	zbetcheckin
2021-07-13 01:38:03	http://lifestyledrinks.pl/wp-includes/VoHMoV.exe	Offline	32 exe njRAT	zbetcheckin
2021-07-12 11:30:04	http://lifestyledrinks.pl/wp-includes/QoVOGG.exe	Offline	exe njRAT rat	abuse_ch

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2021-07-13 22:29:05	ca4519752ddcb19ae2a3d245ba3f620cb9b44e64ef00c7a8553eb70044fc332e	exe		njrat
2021-07-13 01:38:03	6b412461abeb39dca374d4f56db6ecd27f7bc074c494c1553162b6ff8d10cdc1	exe		njrat
2021-07-12 11:30:04	5750ac496c4e8a62e2f46af468ec5a2fdbfd9e13c681644f5d1f2269e3458aad	exe		njrat