URLhaus Database
Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).
Database Entry
| Host: | f6l.su |
|---|---|
| Domain registrar: | REG.RU  |
| Domain registration date: | 2025-10-04 20:08:42 UTC |
| Abuse complaint sent to registrar: | Yes (2025-10-05 06:22:02 UTC to abuse{at}reg[dot]ru) |
| Spamhaus DBL : | Spammer domain |
| SURBL : | Not blocked |
| Quad9 : | Not blocked |
| AdGuard : | Not blocked |
| Cloudflare : | Not blocked |
| ProtonDNS : | Blocked |
| OpenBLD : | Blocked |
| DNS4EU : | Not blocked |
| Control D HaGeZi : | Not blocked |
| Firstseen: | 2025-10-05 06:18:05 UTC |
| Total malware sites : | 8 |
| Online malware sites : | 0 (0%) |
| Offline Malware sites : | 8 (100%) |
| A record(s) observed : | 1 |
IP addresses
The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.
| Firstseen (UTC) | IP address | Hostname | SBL | ASN | Country | Active? |
|---|---|---|---|---|---|---|
| 2025-10-05 06:18:12 | 78.153.140.92 | hostglobal.plus | SBL655362 | AS202306 HOSTGLOBALPLUS-AS |  GB | yes |
Malware URLs
The table below shows all malware URLs that are associated with this particular host.
| Dateadded (UTC) | URL | Status | Tags | Reporter |
|---|---|---|---|---|
| 2025-10-10 18:03:22 | http://f6l.su/b1n/arm7 | Offline | botnetdomain elf mirai  |  BlinkzSec |
| 2025-10-10 18:03:20 | http://f6l.su/b1n/arm | Offline | botnetdomain elf mirai | BlinkzSec |
| 2025-10-10 18:03:20 | http://f6l.su/b1n/mpsl | Offline | botnetdomain elf gafgyt | BlinkzSec |
| 2025-10-10 18:03:20 | http://f6l.su/b1n/arm5 | Offline | botnetdomain elf mirai | BlinkzSec |
| 2025-10-10 18:03:16 | http://f6l.su/b1n/x86 | Offline | botnetdomain elf mirai | BlinkzSec |
| 2025-10-10 18:03:16 | http://f6l.su/b1n/arm6 | Offline | botnetdomain elf mirai | BlinkzSec |
| 2025-10-10 18:03:16 | http://f6l.su/b1n/mips | Offline | botnetdomain elf gafgyt | BlinkzSec |
| 2025-10-05 06:18:12 | http://f6l.su/f | Offline | gafgyt geofenced mirai sh ua-wget USA |  botnetkiller |
The table below shows recent payloads delivery by this host.
| Firstseen (UTC) | SHA256 hash | File type | Bazaar | Signature |
|---|---|---|---|---|
| 2025-10-10 18:03:22 | 53cac28f53366827deb4b633fd717ac0b7caf9b734f9ccc6c4d8dd08bce88c8d | elf | Mirai | |
| 2025-10-10 18:03:20 | a1793fbd07c85bc44b6d7aed17e6781500076338850c47a949990442bbbfadd4 | elf | Mirai | |
| 2025-10-10 18:03:20 | 37430df2891428a057819c8830575371f83ffef3de4d0815454bf30868c98622 | elf | Gafgyt | |
| 2025-10-10 18:03:20 | 8c44be3a689918d4896f0ede2d6069c7b47c894692967dbbe071455a8324510c | elf | Mirai | |
| 2025-10-10 18:03:16 | ba238b5ec5ee126b3e86dc1b814a40982c81b0f283aba9c411e546c3196e0d04 | elf | Mirai | |
| 2025-10-10 18:03:16 | f24aa29212208ed8509f481d5f1946f933647265e2e2f0a6ffcff8362e80e306 | elf | Mirai | |
| 2025-10-10 18:03:16 | 40120b0d2322595e87382ac6c5481a989fc9ded4ff6bbcd773534fe09056ccb0 | elf | Gafgyt | |
| 2025-10-07 15:24:09 | 559ee33f4cde4e72d64034941d25a39787e39667c39c80a25dfcb6b249c7b3fe | sh | Gafgyt | |
| 2025-10-05 06:18:12 | 96ddf13f6dc4db5cb530189bf8f95b9e0dbcd097da618049668128b7610c2127 | sh | Mirai |