URLhaus Database

You are currently viewing the URLhaus database entry for http://178.16.52.80/hold.js which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry


ID:3867581
URL: http://178.16.52.80/hold.js
URL Status:flame Online (spreading malware for 27 days, 15 hours, 46 minutes)
Host: 178.16.52.80
Date added:2026-06-19 14:30:16 UTC
Threat:Malware download Malware download
Reporter: BlinkzSec
Abuse complaint sent (?): Yes (2026-06-19 14:31:20 UTC to abuse{at}omegatech[dot]sc)
Tags:178-16-52-80

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2026-07-15hold.jsjs f7a1832d10ab2537c4e24abb36e77864236f1e6833b6f4892aef374b655126ffn/a 
2026-07-09hold.jsjs 84c6ead251c0c185ceb513df3a283103ec41c529692d6073e70d82b9a6ae29a3n/a 
2026-07-01hold.jsjs f20a6d95f4f0a51963118bdee998cf9b08e254e05a2216a26c6064c20bb1d398n/a 
2026-06-30hold.jsjs 5dec52fa2b00fb5d3b68e976b624abcae604826c2c792a9aa0758e0e550d0d83n/a 
2026-06-26hold.jsjs 7fc42a7656579970e4e84678b749404a02a71c3ead87b897009caebe62a407dfn/a 
2026-06-24hold.jsjs b3cd7648ac0586186b6f00a6370bdab77dcc08689c0b7c7200aa1576209bf967n/a 
2026-06-22hold.jsjs ab887072623a358c9676b18b69a146d2d4395663a146a0e8cda9f4f9292ea89en/a 
2026-06-19hold.jsjs f95f6e35d428da4ac22d77bef6b138828daf6b13871ee8af7f0be6034f590dcdn/a