bazaar.abuse.ch
Classification: Whitelisted
bazaar.abuse.ch is a whitelisted (trusted) hostname. Reported by 6 threat sources, last seen 2026-09-02.
Current activity
- Offline — no longer resolving. Last online 2026-09-02 01:56:44.
- Command & Control server — Used by cybercriminals to control victim computers.
MITRE ATT&CK associations
Malware families: LUMMA STEALER (S1213) ASYNCRAT (S1087) MIMIKATZ (S0002) NJRAT (S0385) REMCOS (S0332) NANOCORE (S0336) WANNACRY (S0366) AGENT TESLA (S0331)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Killmbr | Triage | 2026-03-09 12:08:13 | 2026-09-02 01:00:11 | malicious-activity | |
| Suspicious URL | Triage | 2026-05-03 01:17:59 | 2026-08-29 11:56:20 | anomalous-activity malicious-activity | |
| Agent Tesla | Triage | 2026-03-31 14:58:32 | 2026-08-24 15:37:22 | malicious-activity | S0331 Agent Tesla |
| Wannacry | Triage | 2026-02-14 22:00:05 | 2026-07-20 11:25:29 | malicious-activity | S0366 WannaCry |
| Xorist | Triage | 2026-07-18 20:16:09 | 2026-07-18 20:16:09 | malicious-activity | |
| Nabucur | Triage | 2026-07-14 18:39:19 | 2026-07-14 18:39:19 | malicious-activity | |
| Dynowiper | Triage | 2026-07-13 20:49:34 | 2026-07-13 20:49:34 | malicious-activity | |
| Djvu | Triage | 2026-07-13 17:36:21 | 2026-07-13 17:36:21 | malicious-activity | |
| Ovinrat | Triage | 2026-07-02 07:15:23 | 2026-07-02 07:15:23 | malicious-activity | |
| Modiloader | Triage | 2026-07-01 15:55:46 | 2026-07-01 15:55:46 | malicious-activity | |
| Bianlian_ransomware | Triage | 2026-07-01 15:44:23 | 2026-07-01 15:44:23 | malicious-activity | |
| Xworm | Triage | 2026-05-12 21:27:22 | 2026-06-27 08:12:05 | malicious-activity | |
| Hermeticwiper | Triage | 2026-06-26 17:26:32 | 2026-06-26 17:26:32 | malicious-activity | |
| Smokeloader | Triage | 2026-06-04 20:19:52 | 2026-06-04 20:19:52 | malicious-activity | |
| Nanocore | Triage | 2026-02-26 22:32:02 | 2026-05-28 13:01:41 | malicious-activity | S0336 NanoCore |
| Xmrig | Triage | 2026-05-26 16:00:12 | 2026-05-26 16:00:12 | malicious-activity | |
| Darkcomet | Triage | 2026-05-24 15:08:10 | 2026-05-24 15:08:10 | malicious-activity | |
| Remcos | Triage | 2026-02-24 06:47:19 | 2026-05-21 10:21:01 | malicious-activity | S0332 Remcos |
| Socks5systemz | Triage | 2026-05-16 06:44:54 | 2026-05-16 06:44:54 | malicious-activity | |
| Njrat | Triage | 2026-05-13 06:27:22 | 2026-05-13 06:27:22 | malicious-activity | S0385 njRAT |
| Phorphiex | Triage | 2026-05-12 15:37:39 | 2026-05-12 15:37:39 | malicious-activity | |
| Salatstealer | Triage | 2026-05-03 16:25:25 | 2026-05-03 16:25:25 | malicious-activity | |
| Clearwater | Triage | 2026-04-27 01:15:26 | 2026-04-27 01:15:26 | malicious-activity | |
| Hijackloader | Triage | 2026-04-04 14:17:55 | 2026-04-04 14:17:55 | malicious-activity | |
| Malicious URL | Triage | 2026-02-03 18:06:57 | 2026-04-01 09:12:03 | malicious-activity | |
| Lumma | Triage | 2026-03-22 20:03:19 | 2026-03-22 20:03:19 | malicious-activity | |
| Mimikatz | Triage | 2026-03-21 11:29:24 | 2026-03-21 11:29:24 | malicious-activity | S0002 Mimikatz |
| Cryptolocker | Triage | 2026-03-19 19:15:13 | 2026-03-21 00:34:56 | malicious-activity | |
| Asyncrat | Triage | 2026-03-04 15:03:43 | 2026-03-19 19:56:30 | malicious-activity | S1087 AsyncRAT |
| Quasar | Triage | 2026-02-28 21:17:45 | 2026-02-28 21:17:45 | malicious-activity | |
| Donutloader | Triage | 2026-02-19 10:38:11 | 2026-02-27 17:15:31 | malicious-activity | |
| Discordrat | Triage | 2026-02-27 17:10:29 | 2026-02-27 17:10:29 | malicious-activity | |
| Stealc | Triage | 2026-02-12 00:00:33 | 2026-02-12 00:00:33 | malicious-activity | |
| Lumma Stealer | ThreatFox Abuse.ch | 2025-01-24 09:17:18 | 2025-01-24 09:17:18 | malicious-activity | S1213 Lumma Stealer |
| Top Popularity Site | Cisco Umbrella | 2022-10-08 13:14:15 | 2024-08-19 20:16:20 | benign | |
| Covid19 scam | CCN-CERT | 2020-05-02 11:10:54 | 2023-06-15 06:35:23 | malicious-activity | |
| Malware | Hybrid-Analysis | 2021-07-31 09:00:07 | 2022-01-13 13:48:35 | ||
| Safe site | Maltiverse Research Team | 2021-09-21 18:47:11 | 2021-09-21 18:47:11 | ||
| Generic.Malware | Hybrid-Analysis | 2020-06-07 19:00:18 | 2021-03-16 15:45:19 |
Tags
covid19 coronavirus scam phishing fakecaptcha lumma lummac2 stealer defense_evasion discovery execution impact ransomware credential_access persistence privilege_escalation spyware stealer evasion trojan hijackloader stealc 1 installer loader wannacry worm donutloader vipkeylogger collection keylogger remcos remahost1 rat nanocore valleyrat_s2 backdoor themida discordrat rootkit quasar ping revoked_codesign asyncrat killmbr wiper adware exploit upx cryptolocker default mimikatz bootkit agenttesla suricata clearwater salatstealer xworm phorphiex njrat hacked socks5systemz botnet remotehost darkcomet guest16 motw pyinstaller xmrig miner smokeloader hermeticwiper bianlian_ransomware modiloader ovinrat djvu dynowiper nabucur xoristIP addresses resolved by this hostname
- 151.101.138.49 (2022-12-28 18:03:03)
- 104.155.11.149 (2015-07-30 00:00:00)
- 151.101.1.55 (2017-08-22 11:29:27)
- 151.101.129.55 (2017-08-22 11:29:27)
- 151.101.193.55 (2017-08-22 11:29:27)
- 151.101.65.55 (2017-08-22 11:29:27)
- 151.101.130.49 (2026-05-15 01:32:36)
- 151.101.194.49 (2026-05-15 01:32:36)
- 151.101.66.49 (2026-05-15 01:32:36)
- 151.101.2.49 (2026-05-15 01:32:36)
Whois information
- AS name
- AS54113 Fastly
- Domain
- abuse.ch
- TLD
- ch
- First indexed
- 2020-05-02 11:10:54
- Last updated
- 2026-09-02 01:56:44