URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

Host: morganstat.sbs
Domain registrar:Dynadot -
Domain registration date:2026-06-04 15:06:55 UTC
Spamhaus DBL :Botnet C&C domain
SURBL :Not blocked
Quad9 :Blocked
AdGuard :Not blocked
Cloudflare :Blocked
ProtonDNS :Not blocked
OpenBLD :Blocked
DNS4EU :Not blocked
Control D HaGeZi :Not blocked
Firstseen:2026-07-07 06:13:05 UTC
Total malware sites :2
Online malware sites :0 (0%)
Offline Malware sites :2 (100%)
A record(s) observed :4

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)IP addressHostnameSBLASNCountryActive?
2026-07-07 06:13:08 188.114.96.3Not listedAS13335 CLOUDFLARENETn/ayes
2026-07-07 06:13:08 188.114.97.3SBL691350AS13335 CLOUDFLARENETn/ayes
2026-07-09 08:45:57 104.21.3.203Not listedAS13335 CLOUDFLARENETn/ano
2026-07-09 08:45:57 172.67.131.43Not listedAS13335 CLOUDFLARENETn/ano

Malware URLs

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)URLStatusTagsReporter
2026-07-07 06:46:16https://morganstat.sbs/dl/file/8140e835-c8d0-46...Offline JAMESWT_WT
2026-07-07 06:13:08https://morganstat.sbs/dl/7zOffline abuse_ch

The table below shows recent payloads delivery by this host.

Firstseen (UTC)SHA256 hashFile typeBazaarSignature
2026-07-07 06:46:16c4cddaf681b7edee9ebaea92bc21faeeab7c98556c3f4b3fd3bd1e7c08606fad7z 
2026-07-07 06:13:0826817725650583d99ca3e617a618dd75c0f71bd316b5761780b7361f5f824cadexe