URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2020-08-03 06:47:18	213.158.187.42	cpshared11.tedata.net	Not listed	AS8452 TE-AS	EG	no

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2020-08-21 11:07:04	http://mcmegypt.com/sales/oAqCkdM0ytVawBQ.exe	Offline	MassLogger	Anonymous
2020-08-03 18:41:28	http://mcmegypt.com/a/pwininilogs.txt	Offline	AgentTesla exe opendir	abuse_ch
2020-08-03 18:41:23	http://mcmegypt.com/a/ewininilogs.txt	Offline	AgentTesla exe opendir	abuse_ch
2020-08-03 18:41:13	http://mcmegypt.com/a/dwininilogs.txt	Offline	AgentTesla exe opendir	abuse_ch
2020-08-03 06:47:18	http://mcmegypt.com/a/owininilogs.txt	Offline	AgentTesla exe	gorimpthon

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2020-08-21 11:07:04	c43c8db9b2018480b08abb3f66b6133c3d69c7eb1ea518e07edd980b1737bf21	exe		MassLogger
2020-08-03 18:41:28	d6f534c9ada1be06a4a8e186506a6807f6f2c26b2d0b4c3178d95b7fd09817f4	exe		AgentTesla
2020-08-03 18:41:23	8058646126cba81bea297815cbe34b709b852b5c2b134114c67a7e7c8939045d	exe		AgentTesla
2020-08-03 18:41:13	850541657f538f00222c3a538866386f9bdd3f3a40998dfe1c22445619ee2d4b	exe		AgentTesla
2020-08-03 06:47:18	0e2359712d56cd2288252596dcb2b77f444c2aeb53b3a88846058aa327f8f4cb	exe		AgentTesla