URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2025-04-28 08:44:42	162.241.224.194	box5207.bluehost.com	Not listed	AS31898 ORACLE-BMC-31898	US	no
2021-01-25 16:01:12	108.179.201.198	box6109.bluehost.com	Not listed	AS31898 ORACLE-BMC-31898	US	no

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2021-01-25 16:01:12	https://www.savannah-pipes.co.mz/ma66guh3.zip	Offline	dll Dridex	JAMESWT_MHT

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2021-01-26 11:50:40	b6cf019dca618ebc676b84c40846e0a9a2050689b35845af2f12a93442fb25e8	dll		Dridex
2021-01-26 06:02:29	81222472b041091fc7af2308fee853b197d8b6dd0010dada181c153998535dd0	dll		Dridex
2021-01-25 21:01:18	5f5bea792adc24979fde02125541d92934b19de7590ec132f26fa7c8e8ea97c5	dll
2021-01-25 19:50:16	98d34bcabc9744d79000ed1391ead17a2b3d8bcd4f12999282cce1cd8dcfc059	dll
2021-01-25 18:32:50	00daa3b5a706763ebfee1c9257eab05045c01c9d6598d031cf1dd92495a502ec	dll		Dridex
2021-01-25 17:41:48	bac8f79f5058d93c00717a55e471ebdd374679fca18ba4be874a1a7ada934ca5	dll		Dridex
2021-01-25 16:36:49	448e6d69ce76d5ce2c48979e0132349f3374885fe5a84d197777b315b9450326	dll		Dridex
2021-01-25 16:15:49	f835d874ae6f9f27f1cbb390f419375151846539c2b3b2e8b60e353ff3f62ab8	dll		Dridex
2021-01-25 16:01:11	c21f161caa64284ef5b0ef98af69295916a82b303613ea7ed823ea0e088601e1	dll		Dridex