URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2020-07-03 14:28:58	84.38.180.46	2k4u.ru	Not listed	AS49505 SELECTEL	RU	no
2020-07-02 13:39:05	8.209.110.238		Not listed	AS45102 ALIBABA-CN-NET	DE	no

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2020-07-02 13:39:05	http://luyitaw.com/okasle.exe	Offline	Dridex	Anonymous

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2020-07-02 18:19:49	cc33c8c4eb3588fdd48ddb081f77040283c2f6b8c37777f8202b858b64a5952b	exe
2020-07-02 18:04:17	3d00461fa1d1f5c235f481682b5eed33d83b942936c85e61322a5e115162928c	exe
2020-07-02 17:06:23	fcc0db0ce710f68915b4d73274d69bb5765012b02631bb737c66a32a9a708aab	exe		Dridex
2020-07-02 16:31:44	f365425067c9c92379df7ac5975a44e4059220e92582cdfb8c853f4a8095529a	exe
2020-07-02 15:57:18	c4f35b00490a1875286701b5909053c04668e4ec09da8e4ecd7405a3c136d6b0	exe		Dridex
2020-07-02 15:17:37	cf62e1cdb2dd3f209c719e62340f61a69d442f3b391f43528c603c70ab18c8b6	exe		Dridex
2020-07-02 14:43:33	4160e31c01e1c9fbad1e737efb974a0cb35721023607e831292c26873bdee4db	exe		Dridex
2020-07-02 14:26:30	043da6ea28e1ae44078f4941c3e7db3c63566f4b312121bd3f81b6b3cec0e8d7	exe		Dridex
2020-07-02 13:39:04	a84a6fde4dbc4575700b8be705ed1df6d576e5aa6054aa66f1fae98350484a84	exe		Dridex