URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

Host:	log.whateverittakesdoc.org
Spamhaus DBL :	Not blocked
SURBL :	Not blocked
Quad9 :	Status unknown
AdGuard :	Blocked
Cloudflare :	Not blocked
ProtonDNS :	Status unknown
OpenBLD :	Blocked
DNS4EU :	Blocked
Control D HaGeZi :	Not blocked
Firstseen:	2020-10-01 06:29:32 UTC
Total malware sites :	1
A record(s) observed :	1

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2020-10-01 06:29:33	188.130.138.39		Not listed	AS204490 ASKONTEL	RU	no

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2020-10-01 06:29:33	http://log.whateverittakesdoc.org/importante.dll	Offline	geofenced Gozi ITA ursnif	reecdeep

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Signature
2020-10-02 14:41:28	147bd085ab39c0be297f21613aad892a93ea4bdd0bb20e1d25873aeeab4e02cd	exe
2020-10-02 01:39:31	1f489fc6703dd57a5d322a920c98c60b0a9be1168147e3ab1f0db8fa2ba03dae	exe	Gozi
2020-10-01 15:11:57	6103b1c38fc1eed6098eccf623cc093d0d54288d08ed5e90849f06688fe8b250	dll	Gozi
2020-10-01 09:01:11	f23809150b9ab8cdde2e38049987f158ebd23f72e25488620c5da003da308b50	dll	Gozi
2020-10-01 07:13:36	ff84091bb6f0eee80d98d41baf3ea143b48502d3933c0d9097abdf99618ffcf8	exe	Gozi
2020-10-01 06:38:33	1266fa18e0ae0fa01e2cf72e9055c62ccb1712ee52f94ec80d26ce27196e6897	exe	Gozi