URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

Host: tehnomag.rs
Domain registrar: n/a
Domain registration date:2008-03-14 15:18:25 UTC
Spamhaus DBL :Abused domain (malware)
SURBL :Not blocked
Quad9 :Blocked
AdGuard :Blocked
Cloudflare :Not blocked
ProtonDNS :Blocked
OpenBLD :Blocked
DNS4EU :Not blocked
Control D HaGeZi :Not blocked
Firstseen:2025-10-20 14:07:04 UTC
Total malware sites :2
Online malware sites :2 (100%)
Offline Malware sites :0 (0%)
Newest active malware site :2025-10-20 14:07:06 UTC
Oldest active malware site :2025-10-20 14:07:06 UTC (Age: 7 months, 10 days, 0 hours, 48 minutes)
A record(s) observed :1

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)IP addressHostnameSBLASNCountryActive?
2025-10-20 14:07:06 94.127.7.189cp63.cpanelhosting.rsNot listedAS31042 SERBIA-BROADBAND-AS- RSyes

Malware URLs

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)URLStatusTagsReporter
2025-10-20 14:07:06http://tehnomag.rs/Wheatw.pfmOnlineAgentTesla ext ascii Encoded GuLoader ext NDA0E
2025-10-20 14:07:06https://tehnomag.rs/Wheatw.pfmOnlineAgentTesla ext ascii Encoded GuLoader ext NDA0E

The table below shows recent payloads delivery by this host.

Firstseen (UTC)SHA256 hashFile typeBazaarSignature
2025-10-20 14:07:06409a24b9ea81b221c0120fedcef2a5f09c03e587b810fbbfc23a24c7d0354ef8txt  
2025-10-20 14:07:06409a24b9ea81b221c0120fedcef2a5f09c03e587b810fbbfc23a24c7d0354ef8txt