URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2018-12-17 11:32:04	77.223.141.86	ns1.domain-turk.com	Not listed	AS43391 NETDIREKT-AS	TR	no

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2018-12-18 11:46:05	http://matematikcozumlerim.com/templates/rt_hyp...	Offline	exe Troldesh	zbetcheckin
2018-12-17 11:32:05	http://matematikcozumlerim.com/templates/rt_hyp...	Offline	exe Shade Troldesh	Racco42

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2018-12-29 03:29:19	414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2	exe
2018-12-28 04:04:46	6e748e99e864e4741156e9c47804bd64d04945be2115cdba2a3ca5668bd69f90	exe		Ransomware.Troldesh
2018-12-27 03:52:56	9fd59ba40c26b3161642d5ebb85796b4262e5d5aa5d1e5eceb919b52a8f9b00e	exe		Ransomware.Troldesh
2018-12-26 11:31:02	925b389565fcfca729ebdc6f8aef4aa37186d5ac70ced53099321acdc51086d4	exe		Ransomware.Troldesh
2018-12-19 05:46:49	7701170304fdd48b184aac032391ae3a1f880be6160812d0089049834b3ec828	exe		Ransomware.Troldesh
2018-12-18 13:02:33	f6c3a6ed241e86647c3532bf92594fc3828d0c1be2f50fa97f668d31318eabaf	exe
2018-12-18 11:46:05	30410a14bb30b2f8d59bfc1bb2bee0bc11fe24fba4b04c5dbea514d5f85d18bb	exe		Ransomware.Troldesh
2018-12-18 03:54:47	8eba21c5b2d2dd4c381f576c2c290748af323a4cdb09bc1246e628b2dc60313e	exe