URLhaus Database
Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).
Database Entry
IP addresses
The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.
| Firstseen (UTC) | IP address | Hostname | SBL | ASN | Country | Active? |
|---|---|---|---|---|---|---|
| 2025-04-27 12:40:19 | 107.180.112.242 | 242.112.180.107.host.secureserver.net | Not listed | AS26496 AS-26496-GO-DADDY-COM-LLC | US | yes |
| 2021-09-14 15:53:09 | 148.66.136.217 | Not listed | AS26496 AS-26496-GO-DADDY-COM-LLC | SG | no |
Malware URLs
The table below shows all malware URLs that are associated with this particular host.
| Dateadded (UTC) | URL | Status | Tags | Reporter |
|---|---|---|---|---|
| 2021-09-14 15:53:19 | http://stepupnetworks.com/forage.php | Offline | doc hancitor | |
| 2021-09-14 15:53:16 | http://stepupnetworks.com/containerization.php | Offline | doc hancitor | |
| 2021-09-14 15:53:16 | http://stepupnetworks.com/flight.php | Offline | doc hancitor | |
| 2021-09-14 15:53:09 | http://stepupnetworks.com/wale.php | Offline | doc hancitor |
The table below shows recent payloads delivery by this host.
| Firstseen (UTC) | SHA256 hash | File type | Bazaar | Signature |
|---|---|---|---|---|
| 2026-08-19 14:57:50 | 6f64fd1d75f6b5416e054682f223814b2551d3dd28bb81605a18b8f7f09e8080 | html | ||
| 2026-08-19 08:15:30 | 2169ad2a69713c6622a0bb7ac644684e4bd797c090b0cb51233b3d7dc7c4b05f | html | ||
| 2026-08-18 20:17:55 | e8c38365ac089cd394660a143a61a957c04683269ded699751bf1706ad559c0e | html | ||
| 2026-08-11 03:09:52 | 4cff7718f902770b3318193daf34c989ba070d2179305857e010f3a5a9c05685 | html | ||
| 2026-08-10 23:32:43 | 4851ab1efb4cb37fb686e8de765181d1a43899293ebcf7111cbdc0e19f01a070 | html |

US
SG