URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

Host: www.xuezha.cn
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Not blocked
Control D HaGeZi :Not blocked
Firstseen:2020-07-21 16:45:07 UTC
Total malware sites :1
A record(s) observed :2

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)IP addressHostnameSBLASNCountryActive?
2025-04-27 22:24:46 61.171.113.15Not listedAS4812 CHINANET-SH-AP- CNyes
2020-07-21 16:45:16 148.70.39.145Not listedAS45090 TENCENT-NET-AP- CNno

Malware URLs

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)URLStatusTagsReporter
2020-07-21 16:45:16https://www.xuezha.cn/bznn/parts_service/qlo11x...Offlinedoc emotet ext epoch2 heodo ext spamhaus

The table below shows recent payloads delivery by this host.

Firstseen (UTC)SHA256 hashFile typeBazaarSignature
2020-07-23 06:30:36ecfcada8131c01436ccd879656898e0c54347fc88b8e4c523fcfe2faa885cea5docHeodo
2020-07-21 16:55:508cd09fb6a91f56aafc6d3c8641c8b7027e1e7481422c570419c34e71fc729012doc Heodo
2020-07-21 16:45:15a8b943a097e47e3222f1f622547040b750792f4a6c087e4da6ada2a870d5c483doc Heodo