URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

Host: www.wjconstruction.net
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
ProtonDNS :Not blocked
OpenBLD :Blocked
DNS4EU :Blocked
Control D HaGeZi :Not blocked
Firstseen:2018-06-27 17:38:15 UTC
Total malware sites :4
Online malware sites :0 (0%)
Offline Malware sites :4 (100%)
A record(s) observed :15

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)IP addressHostnameSBLASNCountryActive?
2025-04-27 14:06:39 15.197.148.33a2aa9ff50de748dbe.awsglobalaccelerator.comNot listedAS16509 AMAZON-02- USyes
2025-04-27 14:06:39 3.33.130.190a2aa9ff50de748dbe.awsglobalaccelerator.comNot listedAS16509 AMAZON-02- USyes
2019-11-11 05:49:46 184.168.221.4848.221.168.184.host.secureserver.netNot listedAS26496 AS-26496-GO-DADDY-COM-LLC- USno
2019-11-01 06:23:39 184.168.221.4141.221.168.184.host.secureserver.netNot listedAS26496 AS-26496-GO-DADDY-COM-LLC- USno
2019-11-10 21:43:25 184.168.221.3232.221.168.184.host.secureserver.netNot listedAS26496 AS-26496-GO-DADDY-COM-LLC- USno
2019-11-09 06:47:06 50.63.202.5656.202.63.50.host.secureserver.netNot listedAS26496 AS-26496-GO-DADDY-COM-LLC- USno
2019-10-29 06:13:33 50.63.202.5252.202.63.50.host.secureserver.netNot listedAS26496 AS-26496-GO-DADDY-COM-LLC- USno
2019-10-29 11:41:29 50.63.202.6060.202.63.50.host.secureserver.netNot listedAS26496 AS-26496-GO-DADDY-COM-LLC- USno
2019-05-06 04:15:16 50.63.202.4848.202.63.50.host.secureserver.netNot listedAS26496 AS-26496-GO-DADDY-COM-LLC- USno
2019-05-06 16:16:59 184.168.221.5454.221.168.184.host.secureserver.netNot listedAS26496 AS-26496-GO-DADDY-COM-LLC- USno

Malware URLs

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)URLStatusTagsReporter
2018-07-03 05:47:58http://www.wjconstruction.net/Rechnungszahlung/...Offlinedoc emotet ext heodo ext p5yb34m
2018-06-30 06:27:05http://www.wjconstruction.net/FILE/Direct-Depos...Offlineemotet ext heodo ext p5yb34m
2018-06-29 23:57:30http://www.wjconstruction.net/joiuehtr/Pasado-D...Offlinedoc emotet ext epoch1 heodo ext Cryptolaemus1
2018-06-27 17:38:17http://www.wjconstruction.net/FILE/Direct-Depos...Offlineemotet ext heodo ext p5yb34m

The table below shows recent payloads delivery by this host.

Firstseen (UTC)SHA256 hashFile typeBazaarSignature
2019-11-30 10:10:07c892248a6a9feaaa2b3d10c3fd6382c10d7f07c48ed08e00ab8e4df245d68248html  
2019-11-30 10:08:525a132ae88714fa1b6e9a102939a757bb44b259d10e785b3f35375722e0081600html  
2019-11-30 10:08:215a132ae88714fa1b6e9a102939a757bb44b259d10e785b3f35375722e0081600html  
2018-06-30 08:34:35027c6eff88fad90897f116eb96b21980bdf0d89f36f72df4960726e3334331c6docHeodo