URLhaus Database
Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).
Database Entry
IP addresses
The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.
| Firstseen (UTC) | IP address | Hostname | SBL | ASN | Country | Active? |
|---|---|---|---|---|---|---|
| 2025-04-27 11:20:43 | 136.243.87.214 | senseiweb.nindohost.net | Not listed | AS24940 HETZNER-AS |  DE | yes |
| 2023-09-08 12:34:13 | 178.63.45.64 | senseiweb.nindohost.net | Not listed | AS24940 HETZNER-AS | DE | no |
Malware URLs
The table below shows all malware URLs that are associated with this particular host.
| Dateadded (UTC) | URL | Status | Tags | Reporter |
|---|---|---|---|---|
| 2023-11-30 19:01:08 | https://marrakechchoralmeeting.ma/netTime.exe | Offline |  abuse_ch | |
| 2023-09-08 12:34:13 | http://marrakechchoralmeeting.ma/netTime.exe | Offline | CoinMiner dropped-by-PrivateLoader Phonk |  andretavare5 |
The table below shows recent payloads delivery by this host.
| Firstseen (UTC) | SHA256 hash | File type | Bazaar | Signature |
|---|---|---|---|---|
| 2023-09-12 09:05:22 | 9cf66905f2366518d56c2081e5eef28274f01e7500672c978a93675b8898f505 | exe | Zyklon | |
| 2023-09-10 12:50:19 | 191dee14873cffbbd7659eaccdecbec207c9abb6f0f8d09fca88f465078b547d | exe | Zyklon | |
| 2023-09-09 14:18:13 | eedfd015089bc78818088b6f2466da62bb50da8dd4a940990a2c19a30cba9b2b | exe | Phonk | |
| 2023-09-08 13:16:46 | 9fc9a516b95c3985ec90bf33a5b37161d883f55f715b2733223f2c00a1b23b57 | exe | CoinMiner | |
| 2023-09-08 12:34:13 | ef59e29f2bf2afd60aaf48bc05341247a914996a62271febf41cb552546ac29a | exe | CoinMiner |