URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2025-04-27 20:46:49	135.125.244.84		Not listed	AS16276 OVH	FR	yes
2020-10-20 09:22:05	195.191.240.15	hos106.unaxus.net	Not listed	AS39142 INTERNETGROUP-CLOUD	CH	no

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2020-10-20 09:22:05	http://webinar-service.ch/assets/Reporting/	Offline	doc emotet epoch2 heodo	Cryptolaemus1

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2020-10-20 12:31:07	e839ad79ebc64c9a9f35e974ee0331fb9e05f62ce04e2d5a7a75082ccea2613b	doc		Heodo
2020-10-20 11:47:46	731c494ee06a5fe125c88bd6c5962d440734d6237fd8dd68d3fae0950cdb153d	doc		Heodo
2020-10-20 11:23:19	f13dec9c8a43cc6bd379b02b6ac07a0104d180729a7949b4d7d642344c204f0c	doc		Heodo
2020-10-20 10:56:03	4a9bdef24eed1deb564eebabf43f1296dc75f336b8cedf58f1e531a1a9e69e95	doc		Heodo
2020-10-20 10:03:08	0b50109aa3bc171ff9f379afe7a80a952c4255a6ef6c82aa8dfd5f2d988dfe42	doc		Heodo
2020-10-20 09:56:03	bfcabe02aac68b07c32d86eeda208b75b2029527fad4cdc4839cbe14245d6d7c	doc		Heodo
2020-10-20 09:34:13	59b11da7af351898590c99795dabaa6165941fec5c5e377a4b8edab164b057dd	doc		Heodo
2020-10-20 09:22:05	6ed8baafe6922ca166f88a03248e937ce53a63c5260c3c8942af8a10e5a032a4	doc		Heodo