URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2025-04-27 18:05:15	38.18.228.46	alma.networkaruba.com	Not listed	AS397423 TIER-NET	US	yes
2021-01-21 11:33:12	209.126.8.137	server.networkaruba.com	Not listed	AS40021 CONTABO-40021	US	no

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2021-01-21 11:33:12	https://www.networkaruba.com/k9kl6e.rar	Offline	Dridex	stoerchl

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2021-01-22 04:50:14	ce6b05e2593182af90dc4e8fd315240bec81cf0734a2590ee864a05bbffb014c	exe		Dridex
2021-01-21 23:34:11	e5a09287866a91d3c78e942d1e51dcd9f76d19dfbfed862e5e6a6d97b3f2644f	exe		Dridex
2021-01-21 20:11:45	5a0b3fbea90a0ffc473d9bb8e79cc803c61b9f06966965e878f7b704347353dc	dll		Dridex
2021-01-21 18:26:29	b27e4015c3df0bd4812f4c1b5d031cc1854c4dcc84077a1a8b53c761d352d628	dll		Dridex
2021-01-21 17:08:08	4d81d90fe7cc213a07b51aa6f6773e1c40acb62eba3dccc53b9e8a92abeda405	dll		Dridex
2021-01-21 15:47:22	33fcc052bcd04526d63c591e0c91be8f70ed06e9f461eceb9e11ced1ec8fa7e6	dll		Dridex
2021-01-21 14:27:41	864e95d36584e9db7bcd7552272e446a4c7cbc6601dcd4f4a2687d96374b439b	dll		Dridex
2021-01-21 11:33:11	a9653dacc87403855ff752ff34c6913f5c4f0aec5bfe2c83f95151c9e13d5ba4	dll		Dridex