URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2021-02-12 21:04:46	209.99.40.222	209-99-40-222.fwd.datafoundry.com	Not listed	AS23005 SWITCH-LTD	US	no
2020-10-20 12:22:14	104.198.157.184	184.157.198.104.bc.googleusercontent.com	Not listed	AS396982 GOOGLE-CLOUD-PLATFORM	US	no

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2020-10-20 12:22:14	https://sql.rahatexltd.com/fs/eTrac/32dnikm8ixw...	Offline	doc emotet epoch2 heodo	Cryptolaemus1

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2020-10-20 16:01:40	244b6b7cadea9edf3e0f6a1a48f36de078573de7e255d5725428d636dec58630	doc		Heodo
2020-10-20 15:24:34	09bdf4d7685346bc8a0b288e2b3f4f448e2719f6acdad65bd3bee87c07b97de8	doc		Heodo
2020-10-20 15:03:59	08057a9df9d17da8a860ee860efc60fef7c46b9cc8bf15ffceeb7ed05480b01a	doc		Heodo
2020-10-20 14:37:50	c99265a3670c9b4d1074bb8729b81493df8cd318e80b725d7d6d42e08728b3ad	doc		Heodo
2020-10-20 13:53:44	dc2bf19b8783e823415f8820060f32660a8aa7077eac281739eb380f7168886f	doc		Heodo
2020-10-20 13:12:44	8d265b2a1f4f7b4f035d094bb3c7e31a22449709662db50101e76b3088f309bd	doc		Heodo
2020-10-20 12:37:17	b44bdca0b57d988b3f79fd7800cd0a520220048454d242516043c696a40fedd8	doc		Heodo
2020-10-20 12:22:14	24fdda7a45a8fd1c89cd8b6fb30b6b6e90fbf41b947936afade517a394dbf1ed	doc		Heodo