URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2020-02-15 18:53:07	185.10.185.245		Not listed	AS49505 SELECTEL	RU	no

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2020-02-15 18:53:24	http://vizk2.ug/files/penelop/5.exe	Offline	ArkeiStealer exe	abuse_ch
2020-02-15 18:53:20	http://vizk2.ug/files/penelop/4.exe	Offline	exe	abuse_ch
2020-02-15 18:53:19	http://vizk2.ug/files/penelop/3.exe	Offline	exe	abuse_ch
2020-02-15 18:53:15	http://vizk2.ug/files/penelop/updatewin.exe	Offline	exe	abuse_ch
2020-02-15 18:53:11	http://vizk2.ug/files/penelop/updatewin2.exe	Offline	exe	abuse_ch
2020-02-15 18:53:07	http://vizk2.ug/files/penelop/updatewin1.exe	Offline	exe	abuse_ch

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2020-02-16 13:23:11	87feb111884c4a28d0e11dc1b2e2be4a29c56b40e15d568eea47c3a477cc826e	exe		ArkeiStealer
2020-02-15 18:53:24	6527f985a84df3de50c60973aa046b5ca8363a5a9181fb2eacd6092954a85851	exe		ArkeiStealer
2020-02-15 18:53:15	114ccacb7ca57c01f3540611fdf49e68416544da8d8077f5896434a4b71b01dd	exe
2020-02-15 18:53:11	5caffdc76a562e098c471feaede5693f9ead92d5c6c10fb3951dd1fa6c12d21d	exe
2020-02-15 18:53:05	14c7bec7369d4175c6d92554b033862b3847ff98a04dfebdf9f5bb30180ed13e	exe