URLhaus Database

You are currently viewing the URLhaus database entry for http://2seguro2025.duckdns.org/envifa.vbs which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry

Add tag Remove tag Perform URL rescan Delete this URL Report a False Positive
ID:3651461
URL: http://2seguro2025.duckdns.org/envifa.vbs
URL Status:Offline
Host: 2seguro2025.duckdns.org
Date added:2025-10-04 02:47:29 UTC
Last online:2026-07-14 06:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Status unknown
OpenBLD :Blocked
DNS4EU :Not blocked
Reporter: Riordz
Abuse complaint sent (?): Yes (2026-07-14 00:11:12 UTC to abuse{at}frootvpn[dot]com)
Takedown time:9 months, 9 days, 13 hours, 54 minutes Bad (down since 2026-07-14 06:00:04 UTC)
Tags:opendir RemcosRAT link

Payload delivery

The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2026-07-14envifa.vbstxt af4ba8a010dfa75131e0b57fd00d63ecf9dc954a3c1124cea1c5fc18b848b2adn/a
2026-06-26envifa.vbstxt e21f5b5c6128af1d31f5d303436cb2ceda097638cf3c37bf811276dd08ce7373n/a 
2026-06-24envifa.vbstxt 6cf7fb49069906d389456b59b423209daa129e25e8cb43a6b6c08b166bde31adn/a 
2026-06-04envifa.vbstxt 175567fe310a72319bfd1e1150ef18dbe294f9705e73723affb9ae25f158b742n/a RemcosRAT
2025-11-13envifa.vbstxt 665db16ac62b666672f9a4956b4ef073be4a26b87ca6b6fd7eda2693f8c26f62Virustotal results 20.97% 
2025-10-25envifa.vbstxt 518f191b8a64afb6e05b9965a4ec51cb047ca7e5bae3a6d687c528e8855d0263Virustotal results 17.74% 
2025-10-07envifa.vbstxt 2ede87a5df6d40472428fd2aa27dbb9dd2b3a635892d0baa2054a688039ac082Virustotal results 37.10%RemcosRAT