URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

Host: threedrows.net
Domain registrar: n/a
Domain registration date:2026-08-19 17:44:50 UTC
Spamhaus DBL :Abused domain (malware)
SURBL :Blocked
Quad9 :Blocked
AdGuard :Blocked
Cloudflare :Blocked
ProtonDNS :Blocked
OpenBLD :Blocked
DNS4EU :Not blocked
Control D HaGeZi :Not blocked
Firstseen:2026-08-19 22:22:04 UTC
Total malware sites :3
Online malware sites :0 (0%)
Offline Malware sites :3 (100%)
A record(s) observed :2

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)IP addressHostnameSBLASNCountryActive?
2026-08-19 22:22:05 104.21.0.189Not listedAS13335 CLOUDFLARENETn/ayes
2026-08-19 22:22:05 172.67.128.53Not listedAS13335 CLOUDFLARENETn/ayes

Malware URLs

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)URLStatusTagsReporter
2026-08-22 09:17:12https://threedrows.net/uploads/cl1787387436870.exeOfflinedropped-by-remus Bitsight
2026-08-21 19:31:11https://threedrows.net/uploads/cl1786993325591.exeOfflinedropped-by-remus Bitsight
2026-08-19 22:22:05https://threedrows.net/uploads/cl1786993325592.exeOfflinedropped-by-remus Bitsight

The table below shows recent payloads delivery by this host.

Firstseen (UTC)SHA256 hashFile typeBazaarSignature
2026-08-22 09:17:12812c30f4f6781d4ae521e5b36e43189e6ee3d7e4227282b84788d896016a94a9exe 
2026-08-21 19:31:11372d9ffd6a52d6503025ee4cc1393b8a3d754513b32e6dafd818b3db907ec2a5exe 
2026-08-19 22:22:05372d9ffd6a52d6503025ee4cc1393b8a3d754513b32e6dafd818b3db907ec2a5exe