URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

Host:	newexchangefileservicepromotion.duckdns.org
Spamhaus DBL :	Not blocked
SURBL :	Not blocked
Quad9 :	Not blocked
AdGuard :	Not blocked
Cloudflare :	Not blocked
ProtonDNS :	Not blocked
OpenBLD :	Not blocked
DNS4EU :	Blocked
Control D HaGeZi :	Not blocked
Firstseen:	2020-05-13 05:07:54 UTC
Total malware sites :	15
Online malware sites :	0 (0%)
Offline Malware sites :	15 (100%)
A record(s) observed :	1

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2020-05-13 05:07:54	151.80.14.250		Not listed	AS16276 OVH	FR	no

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2020-05-13 16:34:06	http://newexchangefileservicepromotion.duckdns....	Offline	RTF	0x3c7
2020-05-13 13:48:18	http://newexchangefileservicepromotion.duckdns....	Offline		JAMESWT_MHT
2020-05-13 13:48:16	http://newexchangefileservicepromotion.duckdns....	Offline		JAMESWT_MHT
2020-05-13 13:48:14	http://newexchangefileservicepromotion.duckdns....	Offline		JAMESWT_MHT
2020-05-13 13:48:12	http://newexchangefileservicepromotion.duckdns....	Offline		JAMESWT_MHT
2020-05-13 13:48:09	http://newexchangefileservicepromotion.duckdns....	Offline		JAMESWT_MHT
2020-05-13 13:48:04	http://newexchangefileservicepromotion.duckdns....	Offline		JAMESWT_MHT
2020-05-13 13:47:06	http://newexchangefileservicepromotion.duckdns....	Offline		JAMESWT_MHT
2020-05-13 11:48:09	http://newexchangefileservicepromotion.duckdns....	Offline	RTF	zbetcheckin
2020-05-13 05:36:22	http://newexchangefileservicepromotion.duckdns....	Offline	exe opendir Quakbot	abuse_ch
2020-05-13 05:36:20	http://newexchangefileservicepromotion.duckdns....	Offline	AgentTesla exe opendir	abuse_ch
2020-05-13 05:36:16	http://newexchangefileservicepromotion.duckdns....	Offline	doc opendir	abuse_ch
2020-05-13 05:08:20	http://newexchangefileservicepromotion.duckdns....	Offline	AgentTesla exe Quakbot	gorimpthon
2020-05-13 05:08:07	http://newexchangefileservicepromotion.duckdns....	Offline	AgentTesla exe	gorimpthon
2020-05-13 05:07:54	http://newexchangefileservicepromotion.duckdns....	Offline	AgentTesla exe	jstrosch

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Signature
2020-05-13 14:38:27	be94e95fa4198de64ce8cbc3368a59d8bd8652f2da1d6d1209c52807eee0e7f4	rtf
2020-05-13 14:15:31	66b79bfef21208581a5eef76b2add63bcb388f77b6d7e2f5767640dd63f6f95d	unknown
2020-05-13 13:48:16	10fa4a18e6b8449101b2cdee811564fbdfcea4f70a810dc019123ab17ed6f6aa	rtf
2020-05-13 13:48:12	c2d4e448848d3c1fd4601da0e55cb8f53a7052ea79cacfae2ac07eb75e7eb8a6	rtf
2020-05-13 13:48:09	9c9730aa767a493daa65bed1cc2313337c159dbfe2085f95c9a5e8b39b7894c2	docx
2020-05-13 13:48:04	0a48bc44f7d80d254ca2416e5b5be72b5900e43c76722eae1506d6208272e397	unknown
2020-05-13 13:47:05	199434a6f608ed510aaf3e6b4c3e74f8df346a023cb4583016687d07de0eec02	rtf
2020-05-13 11:59:08	48f55e8b4d25e6930baa25ab4237635dd3bc0549cbedf4dc48fcb39be459f9cf	rtf
2020-05-13 05:39:48	b88f4670c0fe31bddc9a5c9c4ba5b7803ae93e8c6faee7e783e700728babb273	rtf
2020-05-13 05:39:47	17c5a9fb29bce2c657f7b89c087f370715eef0d18ad5c251973221626d1f9e48	exe	AgentTesla
2020-05-13 05:39:46	736330aaa3a4683d3cc866153510763351a60062a236d22b12f4fe0f10853582	exe	Quakbot
2020-05-13 05:36:16	6a804a6e4d8dc8ac69dd6a1e65b36fcf1e15cc5d2eab077728863c12d81a34c3	rtf
2020-05-13 05:25:04	0702729c34578ee78cf3cb883ee298fc4aa67dbb433981790605e4e4afb642ff	exe	AgentTesla
2020-05-13 05:08:20	736330aaa3a4683d3cc866153510763351a60062a236d22b12f4fe0f10853582	exe	Quakbot