URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2021-02-01 11:25:11	162.241.60.240	162-241-60-240.unifiedlayer.com	Not listed	AS19871 NETWORK-SOLUTIONS-HOSTING	US	no
2021-03-10 00:59:29	209.99.40.222	209-99-40-222.fwd.datafoundry.com	Not listed	AS23005 SWITCH-LTD	US	no

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2021-02-01 11:25:11	https://santiago.elmamamobil.com/lmjun5ufp.rar	Offline	Dridex	stoerchl

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2021-02-02 04:35:26	233aef95bdd7850e79f08a077419d45bd1c78ead1de4e1f6708fe7a2df5b4f85	dll		Dridex
2021-02-01 21:20:12	090b98ce9d08c217cfcfe440fb4a307b2c0755d280b918d847c173b4c0b6525b	dll		Dridex
2021-02-01 17:49:10	feada44e845212a5d52e3e05861e296b954b7ef52b916c92967cbc5baa4f2630	dll		Dridex
2021-02-01 14:54:27	26a659ec56c7bd7b83a2f968626c1524bda829e0fefff37ecf4c4fb55ad158e3	dll		Dridex
2021-02-01 14:27:59	85e89192cb6620876fbd1737641340e1f5996dffd1f8f1793922121ba5c26a74	dll		Dridex
2021-02-01 13:52:33	30fd4dcadcd13aa4c7d63456f366f46086584e08164bfec223eda64b08337203	dll		Dridex
2021-02-01 11:44:19	b16827c9219f697ef3af98a0386b1fcf23e4071878acb4a8dff46fffd223b026	dll		Dridex
2021-02-01 11:25:10	c9dbf5b838cc23b4cd9a2ee076ad63b26033a39d7030c1abe8281fbdb5032905	dll		Dridex