URLhaus Database
Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).
Database Entry
IP addresses
The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.
| Firstseen (UTC) | IP address | Hostname | SBL | ASN | Country | Active? |
|---|---|---|---|---|---|---|
| 2023-11-11 08:10:49 | 104.248.159.175 | Not listed | AS14061 DIGITALOCEAN-ASN |  SG | yes | |
| 2023-11-09 11:19:19 | 137.184.115.113 | Not listed | AS14061 DIGITALOCEAN-ASN |  US | no | |
| 2023-08-15 12:23:06 | 159.89.198.162 | Not listed | AS14061 DIGITALOCEAN-ASN | SG | no |
Malware URLs
The table below shows all malware URLs that are associated with this particular host.
| Dateadded (UTC) | URL | Status | Tags | Reporter |
|---|---|---|---|---|
| 2023-08-15 12:23:09 | https://tukudewe.com/js/01b1v2g3.zip | Offline | NetSupport  opendir rat zip |  abuse_ch |
| 2023-08-15 12:23:06 | https://tukudewe.com/js/nine18.zip | Offline | NetSupport opendir rat zip | abuse_ch |
| 2023-08-15 12:23:06 | https://tukudewe.com/js/h3b2_jsg/client32.exe | Offline | exe NetSupport opendir rat | abuse_ch |
The table below shows recent payloads delivery by this host.
| Firstseen (UTC) | SHA256 hash | File type | Bazaar | Signature |
|---|---|---|---|---|
| 2023-08-15 12:23:09 | 7c1f855552f48c308af3249c3f1615799c0c7e0bbd0c70f73bfd5e735b7aa780 | zip | NetSupport | |
| 2023-08-15 12:23:06 | 182a92dd36643a2d9e5728e992904a6b0cdabc3bcef36f6ea4f235e5b124f6fa | zip | NetSupport | |
| 2023-08-15 12:23:06 | 89f0c8f170fe9ea28b1056517160e92e2d7d4e8aa81f4ed696932230413a6ce1 | exe | NetSupport |