URLhaus Database

You are currently viewing the URLhaus database entry for http://redbeat.club/wp-snapshots/nSHQKqSOt/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:306708
URL: http://redbeat.club/wp-snapshots/nSHQKqSOt/
URL Status:Offline
Host: redbeat.club
Date added:2020-02-03 12:00:03 UTC
Last online:2020-02-04 09:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Blocked
Cloudflare :Not blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Blocked
DNS4EU :Blocked
Reporter: spamhaus
Abuse complaint sent (?): Yes (2020-02-03 12:02:04 UTC to abuse{at}hetzner[dot]de)
Takedown time:21 hours, 1 minutes Good (down since 2020-02-04 09:03:32 UTC)
Tags:doc emotet link epoch3 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-02-04invoice 4_562487.docdoc 472a660ae1c53299c2fe2634dfaa5e98f8b58af486bb6268c53d5afa86ceb12dVirustotal results 34.92% Heodo
2020-02-03INVOICE-YC0_0237575.docdoc 0c5e2d4ac205cfbd715b436c95e6441c245602df0329b46b39cefc625778cb71Virustotal results 32.26% Heodo
2020-02-03Invoice-TQGC3921_4262475.docdoc d57a0fcb55cfc66fecd526549db9b296bbf15e4e429f87536ce2f061e4882a8cn/a Heodo
2020-02-03Invoice-TVY35_33277759.docdoc 759fd2ad54957e4994f694a741de7fe5c02a3cee0fee1253b0f54d7a698374bcn/a Heodo
2020-02-03Invoice-831_1627432.docdoc d61945a80c3775c6fa5f83bbcbef80b2838ed5a5804816716b1484a89828eb9bn/a Heodo
2020-02-03Invoice-5303_37142742.docdoc 816a8fbd7af14c078e0e6e2397d96f6c3521003d026818b62dc179e72675b575Virustotal results 32.26% Heodo
2020-02-03INVOICE-5726_44871393.docdoc f596df2719af75a41f3fb9397de58c6a5e0d0d053de182517c44a792bab698e2n/a Heodo
2020-02-03Inv_E86_861962.docdoc c6e28313fe6fabbab880a1cb0fdc6b3f6be718d962c33700f084b34614ae5b5bn/a 
2020-02-03Invoice-F2901_5139120.docdoc 05f763e23c37b03c54b50b075d2a78a675b0e8f1a001bb78601d8edc61033343Virustotal results 33.33% Heodo
2020-02-03invoice-ITMA4364_4175445.docdoc 1d39db5fc3c776e3a42ac01390b9413245d814e4b9f1c73df6b16459cf10289fVirustotal results 27.42% Heodo
2020-02-03INVOICE-TQU6223_08886450.docdoc 4f9d0e3e6b138836f0a9a166f65ba3d279222da0fe4165b194629919e9d5d41cVirustotal results 30.16% Heodo
2020-02-03INVOICE_QKP295_721265.docdoc f21b54582cbdb048f738d93f3ab539cf5c46e9a9edefa28b580b7a2830a6dd51Virustotal results 30.16% 
2020-02-03invoice-ZE801_1804103.docdoc aaacc8e33df93ec5da70a436a4423d2468d206585af0d69765ff6af968f990e1Virustotal results 29.69% Heodo
2020-02-03Invoice S7_669558579.docdoc a8a0557ae25a58f084f7cf1338a7452615702c53e9962881719e4b35ef2f6fc8n/a Heodo