URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2025-04-27 10:23:26	104.21.84.123		Not listed	AS13335 CLOUDFLARENET	n/a	yes
2025-04-27 10:23:26	172.67.192.170		Not listed	AS13335 CLOUDFLARENET	n/a	yes
2021-02-06 13:26:27	104.21.61.25		Not listed	AS13335 CLOUDFLARENET	n/a	no
2020-11-05 15:42:31	172.67.205.45		Not listed	AS13335 CLOUDFLARENET	n/a	no
2020-11-06 14:00:21	85.187.128.21	sg1-ls7.a2hosting.com	Not listed	AS55293 A2HOSTING	SG	no
2020-10-19 17:27:16	104.18.50.76		Not listed	AS13335 CLOUDFLARENET	n/a	no
2020-10-19 17:27:16	104.18.51.76		Not listed	AS13335 CLOUDFLARENET	n/a	no
2020-10-19 17:27:16	172.67.207.127		Not listed	AS13335 CLOUDFLARENET	n/a	no

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2020-10-21 16:07:08	http://sezard.com/wordpress/mtq9xpctk0bryme6yj5...	Offline	doc emotet epoch2 heodo	Cryptolaemus1
2020-10-19 17:27:16	https://sezard.com/wordpress/TviJvE/	Offline	emotet epoch2 exe heodo	Cryptolaemus1

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2020-10-21 16:07:08	52caf1a070aa97f41dee32688e691efd22f50efe87a8f77d4a36a28281c19136	doc		Heodo
2020-10-19 18:14:01	1a38e341d6d7d59bd82d063091f4ceb7590c238069d81adc5bae476d0916269e	exe		Heodo
2020-10-19 17:51:45	5ed63a5e63cdbeb470c5595efeb2c26eadb54ba0d9d8343d2f343fe969239e4c	exe		Heodo
2020-10-19 17:27:15	3132c374d51c9660ac1e9aadaf393f0ca69429f97a71aa4d3de6c988edf0bcc4	exe		Heodo