URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2025-04-27 17:58:27	187.45.193.166	hm2655.locaweb.com.br	Not listed	AS27715 Locaweb_Servios_de_Internet_S/A	BR	yes
2019-10-17 08:44:43	187.45.240.3	hm4487.locaweb.com.br	Not listed	AS27715 Locaweb_Servios_de_Internet_S/A	BR	no
2019-09-06 17:59:08	187.45.240.75	hm5538.locaweb.com.br	Not listed	AS27715 Locaweb_Servios_de_Internet_S/A	BR	no
2019-03-15 21:09:08	187.45.240.34	hm5394.locaweb.com.br	Not listed	AS27715 Locaweb_Servios_de_Internet_S/A	BR	no

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2019-04-22 16:17:08	http://nsrosamistica.com.br/doc/FILE/KmX00dZwwNi/	Offline	emotet heodo	spamhaus
2019-04-17 19:39:05	http://nsrosamistica.com.br/doc/ZEIp-MDjUzPSpe9...	Offline	doc emotet epoch1	Cryptolaemus1
2019-03-15 21:09:08	http://nsrosamistica.com.br/doc/ehh3-47vrn-rxum...	Offline	emotet heodo	spamhaus

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2019-04-22 17:48:19	9dc61237288f3407e9f04701982e9ebb6936df3bc7fb824e790cc70e0157bf3c	doc		Heodo
2019-04-22 17:01:16	e28cc5ae6ab4f5f5be41757a13070a27fb3892e4ce119e44fd501c5c48c44f19	doc		Heodo
2019-04-22 16:17:07	e50a6c104f226840ef430978a8c872f6db7cbe442e3c215cdc099a8a5a42830c	doc		Heodo
2019-04-17 21:38:18	8b1b62324101cb93445ff7f6901e29fa08736ccb407948111e8babc53f3baea6	js
2019-04-17 19:39:05	7460accf81db3640d5f7e1e7b430431adfd687918983e78ecc12a0308f95ec47	js