URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry


Host: zxvbcrt.ug
Abuse complaint sent?: Yes (2024-07-06 05:05:03 UTC to cmusisi{at}uol[dot]co[dot]ug,ksemat{at}eahd[dot]or[dot]ug)
Spamhaus DBL :Not blocked
SURBL :Blocked
Quad9 :Status unknown
AdGuard :Blocked
Cloudflare :Blocked
ProtonDNS :Status unknown
OpenBLD :Blocked
DNS4EU :Not blocked
Control D HaGeZi :Not blocked
Firstseen:2021-06-04 05:58:03 UTC
Total malware sites :17
Online malware sites :0 (0%)
Offline Malware sites :17 (100%)
A record(s) observed :3

IP addresses


The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)IP addressHostnameSBLASNCountryActive?
2024-07-06 05:03:33 91.215.85.223SBL615768AS200593 PROSPERO-AS- RUno
2022-06-20 01:40:44 45.143.201.4free.ntup.netSBL625748AS200195 VERASEL- RUno

Malware URLs


The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)URLStatusTagsReporter
2024-07-06 05:41:38http://zxvbcrt.ug/zxcv.ps1Offlineopendir ps1 NDA0E
2024-07-06 05:37:50http://zxvbcrt.ug/asdfg.exeOfflineexe opendir Rhadamanthys NDA0E
2024-07-06 05:34:26http://zxvbcrt.ug/payload.ps1Offlineopendir ps1 NDA0E
2024-07-06 05:34:24http://zxvbcrt.ug/ali.ps1Offlineopendir ps1 NDA0E
2024-07-06 05:29:28http://zxvbcrt.ug/ghjkl.exeOfflineexe opendir Rhadamanthys NDA0E
2024-07-06 05:28:57http://zxvbcrt.ug/ghjk.exeOfflineexe opendir Rhadamanthys NDA0E
2024-07-06 05:27:02http://zxvbcrt.ug/mkv.ps1Offlineopendir ps1 NDA0E
2024-07-06 05:26:53http://zxvbcrt.ug/net.exeOfflineexe opendir Rhadamanthys NDA0E
2024-07-06 05:20:37http://zxvbcrt.ug/qwertyj1.ps1Offlineopendir ps1 NDA0E
2024-07-06 05:14:46http://zxvbcrt.ug/zxcvb.ps1Offlineopendir ps1 NDA0E
2024-07-06 05:13:49http://zxvbcrt.ug/asdf.ps1Offlineopendir ps1 NDA0E
2024-07-06 05:13:41http://zxvbcrt.ug/telly.ps1Offlineopendir ps1 NDA0E
2024-07-06 05:05:29http://zxvbcrt.ug/pps.ps1Offlineopendir ps1 NDA0E
2024-07-06 05:04:40http://zxvbcrt.ug/qwerty.ps1Offlineopendir ps1 NDA0E
2024-07-06 05:04:37http://zxvbcrt.ug/ppx.ps1Offlineopendir ps1 NDA0E
2024-07-06 05:03:33http://zxvbcrt.ug/native.exeOfflineexe opendir Rhadamanthys NDA0E
2021-06-04 05:58:09http://zxvbcrt.ug/zxcvb.exeOfflineAZORult ext exe RaccoonStealer ext RemcosRAT ext zbetcheckin

The table below shows recent payloads delivery by this host.

Firstseen (UTC)SHA256 hashFile typeBazaarSignature
2024-07-08 11:06:2833682e861b76b0ae22b7361f5b59bb7e69b95e69480156714f01e7044408b546exeRhadamanthys
2024-07-08 10:58:0533682e861b76b0ae22b7361f5b59bb7e69b95e69480156714f01e7044408b546exeRhadamanthys
2024-07-08 10:24:2833682e861b76b0ae22b7361f5b59bb7e69b95e69480156714f01e7044408b546exeRhadamanthys
2024-07-08 10:06:0333682e861b76b0ae22b7361f5b59bb7e69b95e69480156714f01e7044408b546exeRhadamanthys
2024-07-08 09:31:3933682e861b76b0ae22b7361f5b59bb7e69b95e69480156714f01e7044408b546exeRhadamanthys
2024-07-06 05:37:507ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224exe Rhadamanthys
2024-07-06 05:29:267ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224exe Rhadamanthys
2024-07-06 05:28:567ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224exe Rhadamanthys
2024-07-06 05:26:527ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224exe Rhadamanthys
2024-07-06 05:03:337ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224exe Rhadamanthys
2022-06-25 14:32:206887d3d4d5baa135418c2305915c56b448960d03c427f6c63c430465ddaa6547exe RemcosRAT
2022-06-20 01:40:442ced9b36b931b73b1d325bececd01f0e4fa6bd0fff98f8b76f2f45b473311cd0exeAZORult
2021-06-30 13:47:54f353dc700a77a88665e2d6cb4f73396ba3b4437cc3ee9a6a7e095de5f77277c5exeRaccoonStealer
2021-06-04 05:58:09eb352ae2d557edc7edd516a4dd9122a4d7c2ea0646f9844135b7360fec1805f4exe RaccoonStealer