URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2025-04-27 16:35:35	79.124.76.25	christ.ns1.bg	Not listed	AS57344 TELEHOUSE-AS	BG	yes
2021-01-04 13:18:07	79.124.76.20	gerry.ns1.bg	Not listed	AS57344 TELEHOUSE-AS	BG	no

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2021-01-05 09:02:07	http://speed-bg.com/kapa3/ferrazio/typla/jbm/5b...	Offline	exe	abuse_ch
2021-01-05 09:02:06	http://speed-bg.com/kalaz/ferrapos/gudda/aglz/J...	Offline	exe QuasarRAT	abuse_ch
2021-01-04 13:19:05	http://speed-bg.com/kalaz/ferrapos/gudda/aglz/R...	Offline	exe opendir QuasarRAT	abuse_ch
2021-01-04 13:18:07	http://speed-bg.com/kapa2/ferrazio/typla/jbm/GW...	Offline	exe opendir QuasarRAT	abuse_ch

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2021-01-05 09:02:07	22dbe6172d32b9b90d66036688e440a9026524f8c4c61b1c05f45dbd63919483	exe
2021-01-05 09:02:06	41144a1619fe90c98275683389f032396d09687a336817bc65db220836c006b7	exe		QuasarRAT
2021-01-05 00:27:02	3cf331e46b6f16ef2a591637b64865d81b19e016ad3f4f3280aa1a872f1261ab	exe		QuasarRAT
2021-01-04 13:19:05	60d4d26d3a67ea86d793602fa94ea83bdb8e888c4742b2a2601c68f577be4371	exe		QuasarRAT
2021-01-04 13:18:07	8fdc007dd13e7c0c5bbe426da723499db81518697eb84d2fd2a0181996d276fa	exe		QuasarRAT