URLhaus Database
Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).
Database Entry
IP addresses
The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.
| Firstseen (UTC) | IP address | Hostname | SBL | ASN | Country | Active? |
|---|---|---|---|---|---|---|
| 2025-05-14 23:50:15 | 199.59.243.228 | Not listed | AS16509 AMAZON-02 |  US | no | |
| 2025-04-29 02:32:07 | 91.195.240.92 | Not listed | AS47846 SEDO-AS |  DE | no | |
| 2022-03-14 11:52:10 | 77.95.248.78 | web184.hostingdiscounter.nl | Not listed | AS43190 GL-IX-AS |  NL | no |
Malware URLs
The table below shows all malware URLs that are associated with this particular host.
| Dateadded (UTC) | URL | Status | Tags | Reporter |
|---|---|---|---|---|
| 2022-03-14 11:52:10 | http://ponizinny.nl/wp-admin/KdLO9n/ | Offline | dll emotet  epoch5 heodo |  Cryptolaemus1 |
The table below shows recent payloads delivery by this host.
| Firstseen (UTC) | SHA256 hash | File type | Bazaar | Signature |
|---|---|---|---|---|
| 2023-08-02 03:52:41 | 35a309d025e93725168be3f49fe26fb624c13d701829f92162adb03a0e45255f | dll | Heodo | |
| 2023-07-18 14:30:43 | 953d74988c51ea0bbdde5394e4bf3da41dd352c1a784655f30160a5391fb731d | dll | Heodo | |
| 2023-05-26 22:45:27 | fe9715b61d46e3d5a19014b245d5435a8426e0ee7ca4951ac1b515e31f7f1227 | dll | ||
| 2023-02-05 05:27:39 | 7912d21fe2b4bb4d7c782c186cf14fc3d306b9859df377179ab8f1718f07aea0 | dll | Heodo | |
| 2022-09-14 04:18:47 | 4a027751d837878f215fed4aeede3feb3c85c9fecef120d9a30fc4f01e3983cf | dll | Heodo | |
| 2022-03-14 11:52:09 | 811a63df69289200d0b9a5328415aa7a707c7538ef1040ce21da69b5eaf11a63 | dll | Heodo |