urlhaus.abuse.ch

Classification: Malicious

urlhaus.abuse.ch is a malicious hostname. Linked to Wannacry malware. 7 sightings from 3 threat sources (Overlord, Gafgyt), last seen 2026-08-25.

Current activity

  • Online — resolving/reachable. Last checked 2026-10-17 16:39:40.
  • Malware distribution — This indicator is distributing malware.

MITRE ATT&CK associations

Malware families: WANNACRY (S0366)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Wannacry Triage 2026-08-25 18:45:24 2026-08-25 18:45:24 malicious-activity S0366 WannaCry
Overlord Triage 2026-08-23 05:41:50 2026-08-23 05:41:50 malicious-activity
Gafgyt Triage 2026-06-27 21:11:42 2026-06-27 21:11:42 malicious-activity
Malicious URL Triage 2026-03-07 02:47:33 2026-03-07 02:47:33 malicious-activity
Top Popularity Site Cisco Umbrella 2022-07-18 22:33:38 2025-05-17 14:12:33 benign
Malware Download URLhaus Abuse.ch 2025-01-30 08:20:42 2025-01-30 08:20:42 malicious-activity
Generic.Malware Hybrid-Analysis 2019-08-06 10:15:25 2021-04-12 20:00:46
Malicious site Hybrid-Analysis 2020-08-20 17:45:11 2020-08-20 17:45:11

Tags

cobaltstrike backdoor defense_evasion discovery persistence privilege_escalation rat gafgyt botnet overlord execution installer pyinstaller wannacry impact ransomware spyware stealer worm

IP addresses resolved by this hostname

Whois information

AS name
AS54113 Fastly
Domain
abuse.ch
TLD
ch
First indexed
2019-08-06 10:15:25
Last updated
2026-10-17 16:39:40