URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

Host:	yd2.s3.eu-central-1.amazonaws.com
Domain registrar:	MarkMonitor
Domain registration date:	2005-08-18 02:10:45 UTC
Spamhaus DBL :	Not blocked
SURBL :	Not blocked
Quad9 :	Not blocked
AdGuard :	Not blocked
Cloudflare :	Not blocked
ProtonDNS :	Not blocked
OpenBLD :	Not blocked
DNS4EU :	Not blocked
Control D HaGeZi :	Not blocked
Firstseen:	2021-11-16 19:17:08 UTC
Total malware sites :	1
A record(s) observed :	498

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2025-05-20 03:37:06	3.5.135.103	s3-r-w.eu-central-1.amazonaws.com	Not listed	AS16509 AMAZON-02	DE	yes
2021-12-20 14:31:34	52.219.171.74	s3-r-w.eu-central-1.amazonaws.com	Not listed	AS16509 AMAZON-02	DE	yes
2022-12-31 00:11:58	52.219.46.32	s3-r-w.eu-central-1.amazonaws.com	Not listed	AS16509 AMAZON-02	DE	yes
2022-07-29 08:36:18	52.219.75.204	s3-r-w.eu-central-1.amazonaws.com	Not listed	AS16509 AMAZON-02	DE	yes
2025-05-20 15:28:16	3.5.134.105	s3-r-w.eu-central-1.amazonaws.com	Not listed	AS16509 AMAZON-02	DE	no
2025-05-10 13:00:27	3.5.138.248	s3-r-w.eu-central-1.amazonaws.com	Not listed	AS16509 AMAZON-02	DE	no
2025-08-02 12:58:05	3.5.139.141	s3-r-w.eu-central-1.amazonaws.com	Not listed	AS16509 AMAZON-02	DE	no
2025-06-22 16:18:00	3.5.139.192	s3-r-w.eu-central-1.amazonaws.com	Not listed	AS16509 AMAZON-02	DE	no
2025-05-05 21:31:39	3.5.138.165	s3-r-w.eu-central-1.amazonaws.com	Not listed	AS16509 AMAZON-02	DE	no
2025-06-04 12:45:24	3.5.138.193	s3-r-w.eu-central-1.amazonaws.com	Not listed	AS16509 AMAZON-02	DE	no

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2021-11-16 19:17:13	https://yd2.s3.eu-central-1.amazonaws.com/lnsta...	Offline	BRA geofenced MetaMorfo msi ua-msi	abuse_ch

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2021-11-16 19:17:12	f67a12cfac8cc2bd55220006aaef6f26bcb1d46dd5229344c9e56bf547755f5f	msi		Metamorfo