🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

Host: sirinatpetrol.com
Domain registrar: n/a
Domain registration date:2011-07-30 08:12:19 UTC
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
ProtonDNS :Not blocked
OpenBLD :Blocked
DNS4EU :Not blocked
Control D HaGeZi :Not blocked
Firstseen:2023-03-01 15:55:09 UTC
Total malware sites :16
Online malware sites :0 (0%)
Offline Malware sites :16 (100%)
A record(s) observed :3

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)IP addressHostnameSBLASNCountryActive?
2025-08-04 17:16:35 149.34.201.123mail.teknokentyazilim.comNot listedAS208972 gibirnet-tr- TRyes
2025-04-27 10:06:14 31.223.19.131mail.teknokentyazilim.comNot listedAS12735 ASTurkNet- TRno
2023-03-01 15:55:16 83.150.213.159213.150.83.in-addr.arpaNot listedAS219450 VOYAR- TRno

Malware URLs

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)URLStatusTagsReporter
2023-11-24 11:46:08https://sirinatpetrol.com/data.txtOfflineagenziaentrate geo geofenced ITA RemcosRAT ext script JAMESWT_MHT
2023-11-21 05:46:12https://sirinatpetrol.com/dati/Agenzia.zipOfflineagenziaentrate JAMESWT_MHT
2023-11-20 13:44:05https://sirinatpetrol.com/login.phpOffline.url agenziaentrate remcos ext RemcosRAT ext TA544 ffforward
2023-03-14 19:03:45https://sirinatpetrol.com/connect/Offline250255 7710 geofenced Gozi ext ISFB ext ITA redir-302 ursnif ext abuse_ch
2023-03-14 18:59:46https://sirinatpetrol.com/scarica/Offline250255 7710 geofenced Gozi ext ISFB ext ITA redir-302 ursnif ext abuse_ch
2023-03-14 18:59:39https://sirinatpetrol.com/agenzia/Offline250255 7710 geofenced Gozi ext ISFB ext ITA redir-302 ursnif ext abuse_ch
2023-03-01 15:55:28https://sirinatpetrol.com/impresa/Agenzia_Entra...Offlineagenziaentrate Gozi ext ISFB ext ITA pw-marzo2023 ursnif ext JAMESWT_MHT
2023-03-01 15:55:25https://sirinatpetrol.com/impresa/AgenziaEntrat...Offlineagenziaentrate Gozi ext ISFB ext ITA pw-marzo2023 ursnif ext JAMESWT_MHT
2023-03-01 15:55:25https://sirinatpetrol.com/impresa/cliente.zipOfflineagenziaentrate Gozi ext ISFB ext ITA pw-marzo2023 ursnif ext JAMESWT_MHT
2023-03-01 15:55:23https://sirinatpetrol.com/impresa/documenti.zipOfflineagenziaentrate Gozi ext ISFB ext ITA pw-marzo2023 ursnif ext JAMESWT_MHT
2023-03-01 15:55:21https://sirinatpetrol.com/impresa/impresa.zipOfflineagenziaentrate Gozi ext ISFB ext ITA pw-marzo2023 ursnif ext JAMESWT_MHT
2023-03-01 15:55:20https://sirinatpetrol.com/impresa/Direzione.zipOfflineagenziaentrate Gozi ext ISFB ext ITA pw-marzo2023 ursnif ext JAMESWT_MHT
2023-03-01 15:55:19https://sirinatpetrol.com/impresa/Marzo.zipOfflineagenziaentrate Gozi ext ISFB ext ITA pw-marzo2023 ursnif ext JAMESWT_MHT
2023-03-01 15:55:19https://sirinatpetrol.com/impresa/contratto.zipOfflineagenziaentrate Gozi ext ISFB ext ITA pw-marzo2023 ursnif ext JAMESWT_MHT
2023-03-01 15:55:16https://sirinatpetrol.com/impresa/azienda.zipOfflineagenziaentrate Gozi ext ISFB ext ITA pw-marzo2023 ursnif ext JAMESWT_MHT
2023-03-01 15:55:16https://sirinatpetrol.com/impresa/Agenzia.zipOfflineagenziaentrate Gozi ext ISFB ext ITA pw-marzo2023 ursnif ext JAMESWT_MHT

The table below shows recent payloads delivery by this host.

Firstseen (UTC)SHA256 hashFile typeBazaarSignature
2023-11-24 14:36:17565cde7adf8ec06f936f9cec437ed534bac72dedc438635aa6145ac1ccb0960dtxt  
2023-11-24 11:46:0894208d444f2e6290754c07c178fb30c31f942dce18aee825f4e6c5158b0e2251txtRemcosRAT
2023-11-21 05:46:12e02471f33d07a4f9046be6e7b15de68093bb72fdd15b61f3033aea57d9940108zip 
2023-11-20 13:44:052896244e46a61897c47d7c2a15b2c9ca190fffbd12c59e82ffe6355ac42014bcurl  
2023-03-02 07:36:53e083a6989f62788e11476e893ac98a9a9e70ed125903ad23f5c85f55464b0e67zipGozi
2023-03-02 07:24:5581bfdacabe8466d98ffd9fc700a04d05dc9bfe00c04aa409886425121e07c1a4zipGozi
2023-03-02 07:22:39f70f27b8c2d744d2b16ae7e7bbbd1f4064876fc057b3986a657ecd4c7730b647zipGozi
2023-03-02 06:25:56bbab96aeb38f8c35cbb8e95976bbefa62cee70cb9f272c4f40cd227ab7153ffezipGozi
2023-03-02 05:40:15a503b46e481888e739a03ce39104d838d6a4dda1a14f1df24be80ed9e366bc3ezipGozi
2023-03-02 05:39:07bbab96aeb38f8c35cbb8e95976bbefa62cee70cb9f272c4f40cd227ab7153ffezipGozi
2023-03-02 05:38:18ebe2b19437b965394a2e0b19e5b19e19511c99e78849327c29069711891826b4zipGozi
2023-03-02 05:29:55c012156914003f60744671be38a8758aadc9aa3431d60ad8a1a05577c76ced1ezipGozi
2023-03-02 05:28:470147d8553ae0995f17c846d7f0ec8199d0e415b4903a0bb46eaa59303a8689eazipGozi
2023-03-01 15:55:28391db6dff52b7115a7f44911ae9a77cf40c7845ae5624568a4be629bef0d3405zipGozi
2023-03-01 15:55:2561c6c069941bc284108d4e9f1788eb92ed8c18b4c49cd202773999130e9da9e8zipGozi
2023-03-01 15:55:257b512420e2b4c5c8afe3cc9705d185e07dded70dabce74306d698a05dab5f0adzipGozi
2023-03-01 15:55:23bad5c9bb2b9082dbe035d7e0dd5ff616f7db27450f72d29d37e5d357d125305azipGozi
2023-03-01 15:55:2055ba5d8d11fe79f2917dd575334a29b6e2497b2f48c2bba55fe7ab8b192002e2zipGozi
2023-03-01 15:55:19c8afb3065e039176682d5311192b7e567daad4e5e0db4973ea7e44cbbc5e2bc8zipGozi
2023-03-01 15:55:19a763ec89e7f3a2fbf819791230c508a83f56c3363bd05306a989f58824b273e7zipGozi
2023-03-01 15:55:15eea09da92a20969e58975b9694fad56b3decc8c096b8ade0294290ebd2623ac6zipGozi
2023-03-01 15:55:10210314726a8fc1f7b0b65b95f7c400019771f448107faec54b1ef55d82c7e392zipGozi
2023-03-01 15:55:10db7e6763adab35e5583e65b40175deb72e57403804c26d0e55c00a72bddd1f55zipGozi