URLhaus Database

You are currently viewing the URLhaus database entry for http://swellcoolangatta.com/cgi-bin/Reporting/ssi6mg9ejr/zozsa39141218581797v6du2n0krvdul9/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:452821
URL: http://swellcoolangatta.com/cgi-bin/Reporting/ssi6mg9ejr/zozsa39141218581797v6du2n0krvdul9/
URL Status:Offline
Host: swellcoolangatta.com
Date added:2020-09-03 21:42:36 UTC
Last online:2020-09-04 11:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: spamhaus
Abuse complaint sent (?): Yes (2020-09-03 21:44:03 UTC to abuse{at}netregistry[dot]com[dot]au)
Takedown time:13 hours, 38 minutes Good (down since 2020-09-04 11:22:59 UTC)
Tags:doc emotet link epoch2 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-09-04HWTN_YWQLJBXNYS6X0.docdoc f19b7c3502d8e70e4a41fc4676cf0ba7a1de47cc19b1e961be4ceb8511119637Virustotal results 49.15%Heodo
2020-09-04L2WZHPD25P.docdoc 847c5774eaea8a9d9ce3d2a5b91650c30fe5a44a68cb6ab8688236c878787aecn/aHeodo
2020-09-04FILE_AB6049251725OT.docdoc bf8ba4d58a232e576705b37030a7df091539bafb0051f4f28032d54fe49c4c98n/aHeodo
2020-09-03FILE_PO_09042020EX.docdoc f00f58cdf16e19d21e63d94d8fc0be44f2ca6b18df7ca59cb6aed2bba4b5ff97Virustotal results 37.93%Heodo
2020-09-03REP_EJ8720163629TA.docdoc 2e96dcfe760df7dd6db7de3e4a51f33e031a3c1c8d3aa5545cfe92fa072b6189Virustotal results 36.67%Heodo
2020-09-03S_5432203438550745.docdoc dd55e6beb972f2853844f144768be35b2d48bc452f75603155809891a1ff3df4Virustotal results 35.00%Heodo
2020-09-03INV_22494697.docdoc 079755626794412a025b4f2e13b8a7900345b513afb0538ee3f16c638878c800Virustotal results 35.59%Heodo
2020-09-03793119020962247025.docdoc f95add757971b2b4deabdb71a2aaaddf3ea0cd2562b6bf7c1db04298470477baVirustotal results 33.33%Heodo
2020-09-03REP_IAW_090120_RHY_090420.docdoc fed00393d41370e30988376edbbde0a569d0229091e193fc5258cddf22820acbn/aHeodo
2020-09-03REP_TNT_090120_EDR_090420.docdoc 5609621875af24a1bdfe33810c7f333e1853792610f7828310b0bdf8e891e237Virustotal results 31.15% Heodo
2020-09-03BAL_MSO_090120_RCL_090420.docdoc 12f1f6eaba5c14c0f12ebabea1fb99278c07a501323f1c81297b290f8f223b17Virustotal results 31.67%Heodo
2020-09-03A_R057UC2.docdoc 05239277c07c3d58fafd2922235b02d502219aa1490b863913b43a4e8260b705n/aHeodo
2020-09-03J_0FCBATO2YRX.docdoc 3eec4fb22221c450841f1d95abec12b04972403304b3a23ad587c5819a130fc6n/aHeodo
2020-09-03FILE_PO_09042020EX.docdoc 391ee1ac6991a8098ae7c5f9fa1f15ca996f4b7ef6f4a4e09ab742b4126018bfn/a Heodo