URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

Host:	wingsteck.com
Domain registrar:	Public Domain Registry
Domain registration date:	2011-02-17 06:27:05 UTC
Spamhaus DBL :	Not blocked
SURBL :	Not blocked
Quad9 :	Not blocked
AdGuard :	Not blocked
Cloudflare :	Not blocked
ProtonDNS :	Not blocked
OpenBLD :	Not blocked
DNS4EU :	Blocked
Control D HaGeZi :	Not blocked
Firstseen:	2021-09-07 13:14:03 UTC
Total malware sites :	7
Online malware sites :	0 (0%)
Offline Malware sites :	7 (100%)
A record(s) observed :	2

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2022-03-30 12:34:49	66.45.230.3	mintabiz.com	Not listed	AS19318 IS-AS-1	US	yes
2021-09-07 13:14:06	192.185.171.218	192-185-171-218.unifiedlayer.com	Not listed	AS19871 NETWORK-SOLUTIONS-HOSTING	US	no

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2021-09-08 05:18:04	http://wingsteck.com/jss/Proof%20Of%20Payment.exe	Offline		AndreGironda
2021-09-07 15:36:07	http://wingsteck.com/3/P/BLT-7501033098.exe	Offline	a310Logger	zbetcheckin
2021-09-07 15:36:06	http://wingsteck.com/ts/Y/rrrem.exe	Offline	32 exe RemcosRAT	zbetcheckin
2021-09-07 15:02:09	http://wingsteck.com/ts/Y/BLT-750108002.exe	Offline	32 a310Logger exe	zbetcheckin
2021-09-07 14:57:05	http://wingsteck.com/ts/Y/IMG_80350001.exe	Offline	a310Logger	info_sec_ca
2021-09-07 14:57:04	http://wingsteck.com/3/P/TLH_110503078801.exe	Offline	32 exe RedLineStealer	zbetcheckin
2021-09-07 13:14:06	http://wingsteck.com/3/P/DLT_85620000107.exe	Offline	Formbook xloader	James_inthe_box

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2021-09-07 15:36:07	1c5e928b5e27daa837d1ba10187397303520f5b18cf9b5da1eaf28b7f2ba0eda	exe		a310Logger
2021-09-07 15:36:06	4a8ae1e4845f9d27041cef35528f245961cd8b25399096d661d0d93df97375ce	exe		RemcosRAT
2021-09-07 15:02:08	9091f8b24635fc68664a80f7904c1f56344c045513996852a522d5da2a909f73	exe		a310Logger
2021-09-07 14:57:05	f4b224dc05210c0020c5e2f736c3132de81057918783ed65e56add163f92d552	exe		a310Logger
2021-09-07 14:57:04	35d443578b1eb0708d334d3e1250f68550a5db4d630f1813fed8e2fc58a2c6d0	exe		RedLineStealer
2021-09-07 13:14:05	fc24f060e9ffd04558497c27d9694182ab650ef2f985e29017ea63a7b7d3d5a6	exe		Formbook