URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2021-06-02 12:46:17	209.99.40.222	209-99-40-222.fwd.datafoundry.com	Not listed	AS23005 SWITCH-LTD	US	no
2021-01-25 16:41:41	103.87.173.15	stradwhm.stradsolutions.com	Not listed	AS146943 TIER4CLOU-AS	IN	no

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2021-01-25 16:41:41	https://tallyinvoicecustomization.com/a9tguyu.zip	Offline	Dridex dropper	Myrtus0x0

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2021-04-01 02:57:42	7fe44408126e2ce0008d9409c116d3fdc7781c9da4ea3d2e8c75692383c39cff	dll
2021-01-26 11:49:26	b6cf019dca618ebc676b84c40846e0a9a2050689b35845af2f12a93442fb25e8	dll		Dridex
2021-01-26 05:59:17	7b57f3b5f2d8e287acf28a1da368075c24901aa7a1f405b0ad5e33f8ef7fc3ec	dll		Dridex
2021-01-25 21:01:47	172a5fa7dbc656f25b8b62e00fcddcb5f9ec1cb92e53ff056afb8d7f378a77ef	dll
2021-01-25 20:04:30	98d34bcabc9744d79000ed1391ead17a2b3d8bcd4f12999282cce1cd8dcfc059	dll
2021-01-25 19:50:17	7a614702a05f0ea1de4e0df36cd27a12ca1f3d2fd561dcd54038426cbe1f62be	dll
2021-01-25 18:42:37	86ca0c5f7a37f6775c8c8b2eb6cd1802fd9f5c438bd9c75f00f800ccd2cd84b5	dll		Dridex
2021-01-25 17:49:48	1d25971fb74ce8abebeedc3b06d7237b0cdf043e0c362425d95a08f158ae94a4	dll		Dridex
2021-01-25 16:41:41	0b3e6ada39214664cac30a55a1502a76f040b23b569a205504369372c9a36c8a	dll		Dridex