URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2025-04-28 05:31:36	81.169.145.161	wa1.rzone.de	Not listed	AS6724 STRATO	DE	yes
2020-10-27 13:39:08	193.141.3.74	a0a.rzone.de	Not listed	AS6724 STRATO	DE	no

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2020-10-27 13:39:08	https://timsonntag.com/cgi-bin/g/	Offline	emotet epoch1 exe heodo	Cryptolaemus1

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2020-10-27 16:36:37	1387d8f1b3b4ff27eec54de2a66fdbd4725651733053b5f6ecd1af8bdf82a423	exe		Heodo
2020-10-27 15:51:11	c1b93ced1b6f70e7bcd4ddbf20d7e2e68890afe75e1b6190d9740851b9168083	exe		Heodo
2020-10-27 15:45:48	7b522b76b11080ae863b6f06aa8c46e8ffccccb687be89677b23e35d65a1bfa5	exe		Heodo
2020-10-27 15:21:29	e4c73292d0d32fd7fb20f17669461527cf03c275806b2cce98513cf60bc6de2c	exe		Heodo
2020-10-27 14:56:51	8e2e2174fe1920517a7a4d2b60f0a3faa99004989e9d3350daeedb6212babb87	exe		Heodo
2020-10-27 14:47:31	380a953f85e460428e07f682476d23eb717028f90cba25d9b03cbf70a4642986	exe		Heodo
2020-10-27 14:26:14	de6bcc456ab20809310adbc8b52ff0585c7bcd22a24e1bb14fbfbc37d1c172cf	exe		Heodo
2020-10-27 14:15:01	a989d26a53c627764096626f3407b8b20dd96fb3b37ea7af04155debb5d6f4a2	exe		Heodo
2020-10-27 13:56:54	cd2535d46fd05f06586920d7151f567ea61814f036885a9eab1f5d795b91d5fd	exe		Heodo
2020-10-27 13:39:08	e5c35b5f9467191fcb8698b3a7c08c269f1a9fc037db233c5cfd45f646c57329	exe		Heodo