URLhaus Database
Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).
Database Entry
IP addresses
The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.
| Firstseen (UTC) | IP address | Hostname | SBL | ASN | Country | Active? |
|---|---|---|---|---|---|---|
| 2025-04-28 09:03:41 | 66.102.132.19 | sh-cp3.yyz2.servername.online | Not listed | AS40092 ONIAAS |  CA | yes |
Malware URLs
The table below shows all malware URLs that are associated with this particular host.
| Dateadded (UTC) | URL | Status | Tags | Reporter |
|---|---|---|---|---|
| 2022-01-05 17:50:35 | https://lumenhomes.ca/zoptr.exe | Offline | avemaria  AveMariaRAT exe WarzoneRat |  AndreGironda |
| 2022-01-05 01:45:10 | http://lumenhomes.ca/1.exe | Offline | 32 exe RemcosRAT |  zbetcheckin |
| 2022-01-04 22:02:06 | https://lumenhomes.ca/remcos_a.exe | Offline | 32 exe RemcosRAT | zbetcheckin |
| 2022-01-04 21:54:04 | https://lumenhomes.ca/4.exe | Offline | 32 exe RemcosRAT | zbetcheckin |
| 2022-01-04 20:13:04 | https://lumenhomes.ca/coo.exe | Offline | avemaria AveMariaRAT exe WarzoneRat | AndreGironda |
The table below shows recent payloads delivery by this host.
| Firstseen (UTC) | SHA256 hash | File type | Bazaar | Signature |
|---|---|---|---|---|
| 2022-01-05 01:45:10 | 44c6a913e7bf55c4738ca317c22794840e52244a5f71b4275dcbcf7f3f87434b | exe | RemcosRAT | |
| 2022-01-04 22:02:05 | a4b7ad00cc51b383b491106e80508ab05c34ffd331542753b0faa8b043fb1c2a | exe | RemcosRAT | |
| 2022-01-04 21:54:04 | 5b62ade8eb59bc5723c2db77bcfc25fdfd38905803912286afbf7d85ff1e73d5 | exe | RemcosRAT | |
| 2022-01-04 20:13:04 | 35c313910913e40bb54c401361effea91e8b820321d432babd831a7e93684e51 | exe | AveMariaRAT |