URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2025-04-27 14:22:20	23.227.38.74	shops.myshopify.com	Not listed	AS13335 CLOUDFLARENET	CA	yes
2019-11-19 11:27:37	198.185.159.144		Not listed	AS53831 SQUARESPACE	US	no
2019-11-19 11:27:37	198.185.159.145		Not listed	AS53831 SQUARESPACE	US	no
2019-11-19 11:27:37	198.49.23.144		Not listed	AS53831 SQUARESPACE	US	no
2019-11-19 11:27:37	198.49.23.145		Not listed	AS53831 SQUARESPACE	US	no
2019-10-08 19:54:10	45.56.100.50	45-56-100-50.ip.linodeusercontent.com	Not listed	AS63949 AKAMAI-LINODE-AP	US	no

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2019-10-12 01:32:07	https://www.denedolls.com/wp-content/upgrade/2l...	Offline	emotet epoch1 exe heodo	Cryptolaemus1
2019-10-11 13:28:37	http://www.denedolls.com/wp-content/upgrade/2lo...	Offline	emotet epoch1 exe	Cryptolaemus1
2019-10-08 19:54:10	http://www.denedolls.com/wp-content/upgrade/ogh...	Offline	emotet epoch1 exe heodo	p5yb34m

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2019-10-13 08:58:24	2a274443136d602107f0572bd62ef67d0b056a7fd007d880e0a4f8277d94dd46	exe		Heodo
2019-10-12 11:09:09	c725c4069b6bc088bd634654961e60ed09c5bb1aa35b214b6a86a86dd63da8e6	exe		Heodo
2019-10-12 01:32:05	9226a5552470fc7a251c1aaf5ca873e15c787cd9f7266e3d3977c8028e4036ce	exe		Heodo