URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2025-10-27 14:56:33	92.113.23.252		Not listed	AS47583 AS-HOSTINGER	DE	no
2025-09-30 15:19:45	92.113.16.208		Not listed	AS47583 AS-HOSTINGER	DE	no
2025-08-23 02:43:53	92.113.16.248		Not listed	AS47583 AS-HOSTINGER	DE	no
2025-10-09 02:45:34	92.113.16.116		Not listed	AS47583 AS-HOSTINGER	DE	no
2025-09-18 18:46:53	92.113.23.33		Not listed	AS47583 AS-HOSTINGER	DE	no
2025-08-07 22:09:25	92.113.23.170		Not listed	AS47583 AS-HOSTINGER	DE	no
2025-10-01 11:11:02	92.113.23.192		Not listed	AS47583 AS-HOSTINGER	DE	no
2025-10-16 20:30:17	92.113.16.243		Not listed	AS47583 AS-HOSTINGER	DE	no
2025-07-28 01:02:21	92.113.16.178		Not listed	AS47583 AS-HOSTINGER	DE	no
2025-08-02 13:33:54	92.113.23.145		Not listed	AS47583 AS-HOSTINGER	DE	no

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2020-12-08 10:06:07	http://siemensagent.com/ny2tqv.zip	Offline	dll Dridex	JAMESWT_MHT

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2020-12-08 14:29:30	53761d0f5f72217c474b25194266d8eb6cb443ef24b7cb8faf5fa1c5be9c4bcc	dll		Dridex
2020-12-08 10:06:07	0e05563f14300ca66f0bc35532feb92e6e0023e8bb124de7975cc1a5de97d714	dll		Dridex