URLhaus Database

You are currently viewing the URLhaus database entry for http://ikbenpink.be/cgi-bin/rwi/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:421357
URL: http://ikbenpink.be/cgi-bin/rwi/
URL Status:Offline
Host: ikbenpink.be
Date added:2020-07-29 11:21:34 UTC
Last online:2020-07-29 18:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2020-07-29 12:40:04 UTC to abuse{at}transip[dot]nl)
Takedown time:5 hours, 22 minutes Good (down since 2020-07-29 18:02:33 UTC)
Tags:doc emotet link epoch3 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-07-29Invoice ZX4337{:REGEX:.docdoc 6ecb72b433b635a49ee2f82737cec4103d08d18e988b42d36bd1b35d175ef612Virustotal results 33.87%Heodo
2020-07-29Invoice ZX4337{:REGEX:.docdoc 6ecb72b433b635a49ee2f82737cec4103d08d18e988b42d36bd1b35d175ef612Virustotal results 33.87%Heodo
2020-07-29Invoice WYU8975-6776595.docdoc 6c3d8011d58d421f0db32a2fbd7ff2dfc39c7fe557dedcd503aca7d97d7a1e80Virustotal results 33.87%Heodo
2020-07-29Inv_H5906{:REGEX:.docdoc 4dbfbd8a057e49274bd92c01fa9680f9b478eaf207fa1c55aeb36d7879a35b27Virustotal results 33.87% Heodo
2020-07-29Invoice T750-48013871.docdoc 4800ef4ce359d4cfcba1becb6f8f276e0e968f7184af96279a1c448b897cccben/a Heodo
2020-07-29Inv_3278-8086399.docdoc 2b598aa9138b54494d8e2eee6e6ab2d4627435a601b4b4293588b24946496a92Virustotal results 33.87% Heodo
2020-07-29Inv-K4{:REGEX:.docdoc f29b787c2bbd9eb52c1da54bb04418fd7a97a3e4af81f813d51384b44f8df8feVirustotal results 35.00% Heodo
2020-07-29Invoice-LQYW2422_5981596.docdoc b6a9f957e44d1bfa48db457b2108328a4062ff4011955cbdc680715916879c6en/a Heodo
2020-07-29Invoice-071{:REGEX:.docdoc 4fcf5c5d7a3296eae7876be45da5f2043bb300507716ac8927c882b5faeb1c2bVirustotal results 33.87% Heodo
2020-07-29invoice-968{:REGEX:.docdoc 1ddd4cbe0cce870cff910c166130add090f1e48f6f6c146f30cc368b32df026en/a Heodo
2020-07-29InvoiceQKF62 031112704.docdoc 9b170d1513d2e3329d1d0175a661e0b646b9d374bb6cb73b7b32103438a80430Virustotal results 30.00% Heodo
2020-07-29INVOICE-YZRC4{:REGEX:.docdoc c0ec41394c2d55c0cc47feaeb28e0b9e39a1fbf831ce6d675329aefa97dcd43fVirustotal results 28.33%Heodo
2020-07-29invoice ZSL045-6597511.docdoc 579b15c447154b6113417ba91fbf52c227a7bf0a0044311929dcf20a48481779Virustotal results 28.81% Heodo
2020-07-29InvMI229 99994436.docdoc b55637e397616929dd5aa9a5dce20753de9ecf2de51cd00672d022fe335ee5c6Virustotal results 27.87% Heodo
2020-07-29Invoice-KC1-241525126.docdoc faf515ab474069ff648bbe291975efe9b7be1e0354b0e61b6c4fc9e91d0880fdVirustotal results 28.81% Heodo
2020-07-29invoice1_7614533.docdoc 048fa686a033e894b6ab66472e3add1b8e1d6bbcf6b2f3abe4be995f54c3e61eVirustotal results 27.87% Heodo