URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry


Host: shoesforsale.net
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Not blocked
Cloudflare :Blocked
ProtonDNS :Status unknown
OpenBLD :Blocked
DNS4EU :Blocked
Control D HaGeZi :Not blocked
Firstseen:2020-10-19 11:53:03 UTC
Total malware sites :1
A record(s) observed :18

IP addresses


The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)IP addressHostnameSBLASNCountryActive?
2025-09-10 04:12:57 13.248.213.45a67c48129651a0940.awsglobalaccelerator.comNot listedAS16509 AMAZON-02- USno
2025-09-10 04:12:57 76.223.67.189a67c48129651a0940.awsglobalaccelerator.comNot listedAS16509 AMAZON-02- USno
2025-04-28 00:23:57 15.197.148.33a2aa9ff50de748dbe.awsglobalaccelerator.comNot listedAS16509 AMAZON-02- USno
2025-04-28 00:23:57 3.33.130.190a2aa9ff50de748dbe.awsglobalaccelerator.comNot listedAS16509 AMAZON-02- USno
2021-03-17 16:34:27 103.224.212.219lb-212-219.above.comNot listedAS133618 TRELLIAN-AS-AP- AUno
2021-03-24 01:26:03 70.32.1.32ip-70.32.1.32.hosted.by.gigenet.comNot listedAS32181 ASN-GIGENET- USno
2021-04-18 14:11:13 170.178.168.203becrawl-show.flatreutic.comNot listedAS46844 SHARKTECH- USno
2021-01-15 00:59:43 47.245.25.30Not listedAS45102 ALIBABA-CN-NET- JPno
2021-01-15 00:59:43 47.245.26.101Not listedAS45102 ALIBABA-CN-NET- JPno
2021-01-15 00:59:43 47.245.26.72Not listedAS45102 ALIBABA-CN-NET- JPno

Malware URLs


The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)URLStatusTagsReporter
2020-10-19 11:53:05https://shoesforsale.net/wp-includes/INC/Offlinedoc emotet ext epoch2 heodo ext Cryptolaemus1

The table below shows recent payloads delivery by this host.

Firstseen (UTC)SHA256 hashFile typeBazaarSignature
2020-10-19 17:52:08ed402993911da9482150ecc427615ce3a06896551711f04ae4f7047afd9e7adedocHeodo
2020-10-19 17:29:01e76c541de939c23796a9093b300a1f31ebe1be4712dca0efaef6ed5218525f93docHeodo
2020-10-19 17:15:294b906d56dd10c8d471dca7a08528213a88203b7c6f04a960e2a5a76cc6222788docHeodo
2020-10-19 16:45:11f9bb2c1295e01206b01528ccd2e09f1662a6f12468249ec30238ae7187723fefdocHeodo
2020-10-19 16:15:232e7dd0cdfb94a9aaa5584499208c22a7bc3ea2fdc0a26c0e408a622a0e94b6aedocHeodo
2020-10-19 15:30:28d95cf2e0e51389df6e97878b1c041fd79f3e61abafc8ff61bcfb691562625e5bdocHeodo
2020-10-19 15:27:515ecc6d05457c8d3f382c04c9186f74ec16a9d9da9c1d7c3dd0c392afae7cf852docHeodo
2020-10-19 14:52:564654f7a3e01f6c38053257a6fbbd0b52b2262ec650daf49240ad4d74bc6b519bdocHeodo
2020-10-19 14:38:2882e4745aa3cb7c221377f4b45307959b841347623658e6cec425aa46aa53c2c8docHeodo
2020-10-19 14:14:275a4b96835cb31f2c12b162545d8c9436cc37e1f1c73bfe23d0ad5c5653f71828docHeodo
2020-10-19 13:44:18b00e19e0b56e69a03215209a1f17f5d78266aed24879127ededa6fa200017f0edocHeodo
2020-10-19 13:31:14e073f07f9088110a389e50314ee391ff0b82bcf678873d348cf51f6a830dba48docHeodo
2020-10-19 13:05:4815a34016820d6fe00738d302233649f24777f6d66081bcd7a6eaab0ebca91bbddocHeodo
2020-10-19 12:59:30c4a82a8cbffbb0e1398e3429b37d9adda018c824d1c0235ddf77c8bd57efd334docHeodo
2020-10-19 12:35:24ed66e0f22e3b96d3918bed90a9e15db325d5f4386c98c5dec1fb9b19aba19dccdocHeodo
2020-10-19 12:08:12f1b420722c2f21d74998a977673f6f6828734c88872d04003b47b509799eeefedocHeodo
2020-10-19 11:53:05aa0236ae4db1c9739afd7a54e78f7c138a289c6afe0f67d41280555fc12dccd7docHeodo