URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2020-03-30 06:13:11	103.133.104.32		Not listed	AS135905 VNPT-AS-VN	VN	no

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2020-03-30 06:13:11	http://prodigorganizationalgroupoffrdy1company....	Offline	AgentTesla exe GuLoader	oppimaniac

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2020-04-01 11:00:42	85dbeb7d05c17a75b1d10eb2f79bf3a18dbefad4dfc9e5caa7b3768e25fda714	exe		GuLoader
2020-03-31 23:15:25	46be801a348720d8c51d0ffa9ef2788accb29f572a94dc9f5059c5540771ca03	exe		GuLoader
2020-03-31 12:03:35	e61849ceab8d8e5f3a9c09117c9af1e1e3c52d522476fc0698d9eac60e439002	exe		AgentTesla
2020-03-30 06:13:10	dc5aa227079d5f33af016f3160e4f33994aa9fece3d7d7eed3fb09c8c8271b7e	exe		AgentTesla