URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

Host:	rf9480.bomj.xyz
Domain registrar:	Namecheap
Domain registration date:	2021-04-20 13:56:57 UTC
Spamhaus DBL :	Not blocked
SURBL :	Not blocked
Quad9 :	Status unknown
AdGuard :	Not blocked
Cloudflare :	Not blocked
ProtonDNS :	Status unknown
OpenBLD :	Not blocked
DNS4EU :	Not blocked
Control D HaGeZi :	Not blocked
Firstseen:	2022-01-13 10:19:03 UTC
Total malware sites :	1
A record(s) observed :	2

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2022-01-13 10:19:04	95.175.110.170	bomj.xyz	Not listed	AS49282 FICOLO	FI	no
2023-04-20 15:44:25	99.83.154.118	a51062ecadbb5a26e.awsglobalaccelerator.com	Not listed	AS16509 AMAZON-02	US	no

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2022-01-13 10:19:04	http://rf9480.bomj.xyz/eth.bin	Offline	exe RedLineStealer	vxvault

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2022-01-16 06:58:47	ee1bab7324428b7496340a53790250f3a73c0f9f851f41824ad877f1cc4c5f95	exe		RedLineStealer
2022-01-15 06:04:54	41e7079f67cdcab8eafda74764683ce2cbfdc9f9b92d0c302a7c4d240142b7cf	exe		RedLineStealer
2022-01-13 18:40:34	fe41e6fb0efb986d46e587b2768a744b7938397c78f4da6e21175a7ea39d31e0	exe		RedLineStealer
2022-01-13 10:19:04	a233b4b4782811424b0b5b166b0985417e834da2b776e72d3c7e5064dee1e9e5	exe		RedLineStealer