URLhaus Database
Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).
Database Entry
IP addresses
The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.
| Firstseen (UTC) | IP address | Hostname | SBL | ASN | Country | Active? |
|---|---|---|---|---|---|---|
| 2025-04-27 14:34:20 | 186.202.157.79 | Not listed | AS27715 Locaweb_Servios_de_Internet_S/A |  BR | yes | |
| 2019-09-04 18:20:49 | 187.45.240.75 | hm5538.locaweb.com.br | Not listed | AS27715 Locaweb_Servios_de_Internet_S/A | BR | no |
| 2019-04-06 01:46:25 | 187.45.195.10 | hm3055.locaweb.com.br | Not listed | AS27715 Locaweb_Servios_de_Internet_S/A | BR | no |
Malware URLs
The table below shows all malware URLs that are associated with this particular host.
| Dateadded (UTC) | URL | Status | Tags | Reporter |
|---|---|---|---|---|
| 2019-04-17 19:43:05 | http://maodireita.com.br/files/oxlHw-vZpJ5Jarmj... | Offline | doc emotet  epoch1 |  Cryptolaemus1 |
| 2019-04-06 01:46:26 | http://maodireita.com.br/files/CnXP-2qeu9RLKiSB... | Offline | emotet heodo |  spamhaus |
| 2019-04-06 01:46:25 | http://maodireita.com.br/files/QNddk-hC0EljBURg... | Offline | emotet heodo | spamhaus |
The table below shows recent payloads delivery by this host.
| Firstseen (UTC) | SHA256 hash | File type | Bazaar | Signature |
|---|---|---|---|---|
| 2019-04-17 21:38:48 | 8b1b62324101cb93445ff7f6901e29fa08736ccb407948111e8babc53f3baea6 | js | ||
| 2019-04-17 19:43:04 | 7460accf81db3640d5f7e1e7b430431adfd687918983e78ecc12a0308f95ec47 | js | ||
| 2019-04-06 01:46:26 | ffbe73591031973cb52f6950ed61b168a0f0bda69f004db08846dfc1bd1d1920 | js | Heodo | |
| 2019-04-06 01:46:24 | ffbe73591031973cb52f6950ed61b168a0f0bda69f004db08846dfc1bd1d1920 | js | Heodo |