URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2020-04-27 06:33:08	159.69.193.56	static.56.193.69.159.clients.your-server.de	Not listed	AS24940 HETZNER-AS	DE	yes

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2020-04-27 08:37:03	http://www.anjelo-directhelp.de/img/jonl.jpg	Offline	exe Smoke Loader	zbetcheckin
2020-04-27 08:33:03	http://www.anjelo-directhelp.de/img/idir.jpg	Offline	exe Formbook	zbetcheckin
2020-04-27 08:14:06	http://www.anjelo-directhelp.de/fotos/19397.jpg	Offline	exe	zbetcheckin
2020-04-27 07:56:34	http://www.anjelo-directhelp.de/fotos/ajay.jpg	Offline	exe	zbetcheckin
2020-04-27 06:33:08	http://www.anjelo-directhelp.de/fotos/bbox.jpg	Offline	exe Smoke Loader	zbetcheckin

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2020-04-27 08:37:03	74d7685801115001e74281cb0c8a046eedd30d3b2fec2b317ad58ca43fcc0694	exe		Smoke Loader
2020-04-27 08:33:03	3c11a65f6d2550c8a8bc81c3a98947f7ca10ae3db068823fee9bcd0e868bc6a0	exe		FormBook
2020-04-27 08:14:06	65c86813da2eb5bfc495e538fa4e77f8c3a3c03418e655ac8262bc0aa42281ba	exe
2020-04-27 07:56:34	cb663a4fa79cb0fcb52c3049b65b1a012c45e72badc13c931fc2c72a8a94dcca	exe
2020-04-27 06:33:08	693626ad4ce750ecb027980dfb505ca69872923702dfe564e0adcb651e8c60d9	exe		Smoke Loader