URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

Host:	tehranring.com
Spamhaus DBL :	Not blocked
SURBL :	Not blocked
Quad9 :	Not blocked
AdGuard :	Not blocked
Cloudflare :	Not blocked
ProtonDNS :	Not blocked
OpenBLD :	Blocked
DNS4EU :	Not blocked
Control D HaGeZi :	Not blocked
Firstseen:	2018-07-03 00:07:05 UTC
Total malware sites :	1
A record(s) observed :	4

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2025-08-08 02:49:48	185.106.201.98	fwx.srv179.irwebspace.com	Not listed	AS212216 Netafraz	IR	yes
2020-01-09 06:02:02	91.195.240.87		Not listed	AS47846 SEDO-AS	DE	no
2018-07-03 00:07:07	94.232.168.158		Not listed	AS48434 Tebyan	IR	no
2025-08-24 17:32:57	94.23.162.163	ns2.emailverification.info	Not listed	AS16276 OVH	DE	no

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2018-07-03 00:07:07	http://tehranring.com/Greeting-messages/	Offline	doc emotet epoch1 heodo	Cryptolaemus1

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2018-07-11 06:32:58	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	unknown
2018-07-03 00:07:07	98be60ec830e2f1974e8d7ddd3626e88ad60476a36d3344662a08f1c9fb83182	doc		Heodo