URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2019-12-24 11:16:28	104.253.94.126		Not listed	AS64445 AS-NETJOIN	IT	no
2019-09-29 17:54:13	208.91.197.46		Not listed	AS40034 CONFLUENCE-NETWORK-INC	VG	no
2018-09-29 06:36:10	204.11.56.48		SBL494567	AS40034 CONFLUENCE-NETWORK-INC	VG	no
2018-07-10 11:20:51	209.200.154.38	a209-200-154-38.deploy.static.akamaitechnologies.com	Not listed	AS213120 PROLEXIC-IP-PROTECT	US	no
2018-07-25 06:08:06	209.200.154.50	a209-200-154-50.deploy.static.akamaitechnologies.com	Not listed	AS213120 PROLEXIC-IP-PROTECT	US	no
2018-05-29 19:39:13	69.160.38.2	svr163.edns1.com	Not listed	AS20454 SSASN2	US	no

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2018-06-12 13:34:05	http://nepapiano.com/VBrs/	Offline	emotet heodo payload	Cryptolaemus1
2018-06-07 17:52:03	http://nepapiano.com/ACCOUNT/Auditor-of-State-N...	Offline	doc emotet epoch1 heodo	Cryptolaemus1
2018-06-06 15:18:14	http://nepapiano.com/ups.com/WebTracking/WL-263...	Offline	doc emotet heodo	Cryptolaemus1
2018-05-29 19:39:13	http://nepapiano.com/ups.com/WebTracking/LOJ-07...	Offline	doc emotet heodo	Cryptolaemus1

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2018-06-09 13:20:14	a8ede5b4e9ad5f52a3c28142fa26a4c2caa2d9bd9e73aead41942d31986e4abe	doc		Heodo