URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2021-03-01 14:04:08	198.23.62.74	243.kpservers.com	Not listed	AS14555 LIQUIDNETLTD1	US	no

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2021-03-01 14:59:12	http://namnyak.co.ke/tlj3mvw.zip	Offline	Dridex	wato_dn
2021-03-01 14:04:08	https://namnyak.co.ke/tlj3mvw.zip	Offline	Dridex	stoerchl

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2021-04-01 10:21:02	b26c491a5a41867d8b9669b61d473acb66b43e1509c1583617dac307428e4637	dll		Dridex
2021-03-17 08:40:38	8add5edf41a292dc19a450334c78fd472fe435671b8fe9697cddbad5c368bda7	dll		Dridex
2021-03-02 06:23:39	80e6030c16c508be90e4c535bbbc1bdbccdfa6438c1cac7d35b8e2067fe517d3	dll		Dridex
2021-03-02 06:21:25	80e6030c16c508be90e4c535bbbc1bdbccdfa6438c1cac7d35b8e2067fe517d3	dll		Dridex
2021-03-01 18:28:10	651a3240a51791a9a14b5df4c42b676442c9d790410bdb083407fa15cf990f83	dll		Dridex
2021-03-01 18:27:37	651a3240a51791a9a14b5df4c42b676442c9d790410bdb083407fa15cf990f83	dll		Dridex
2021-03-01 15:21:39	d49d77aa68853af81d3cb907752a434b5220a2be721d28a6959b1f129e51b8b1	dll		Dridex
2021-03-01 14:59:12	d49d77aa68853af81d3cb907752a434b5220a2be721d28a6959b1f129e51b8b1	dll		Dridex
2021-03-01 14:04:07	a44becb6f8b4f8ebe74fbcd27c2da5e05af9eed2cacc281ba7412757a9041d83	dll		Dridex