URLhaus Database

You are currently viewing the URLhaus database entry for http://103.20.102.84/sh4 which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:3569014
URL: http://103.20.102.84/sh4
URL Status:Offline
Host: 103.20.102.84
Date added:2025-06-21 19:48:08 UTC
Last online:2025-08-06 00:XX:XX UTC
Threat:Malware download Malware download
Reporter: NDA0E
Abuse complaint sent (?): Yes (2025-06-21 19:49:11 UTC to hm-changed{at}vnnic[dot]vn)
Takedown time:1 month, 15 days, 4 hours, 19 minutes Bad (down since 2025-08-06 00:08:48 UTC)
Tags:censys elf mirai link ua-wget

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2025-08-05n/aelf 80f711fa14fe135a23c1d31064d83545f41f3df1e0c8c88ec0442ec7b8eb9d34n/aMirai
2025-07-16n/aelf 1359dbe786fd3644254db582b783e71dcd7ef90b8839b4eb0d094ea2e3241470n/aMirai
2025-07-07n/aelf a9f5e4e549b48e5467e9db4de8e5f7f13ba0e06780710c60c77fa2e8d0495158n/aMirai
2025-06-26n/aelf 435309ef94da6a04fe8cbf485f672728890fde16635a89912702afb262113365Virustotal results 31.25%Mirai
2025-06-23n/aelf 23a6fe3103ad8adb5e45a3ccbb10488491c3c1fa8fee2b0effd2cebc68291e13n/aMirai
2025-06-21n/aelf 9f203e5706c2cad3fc7b6296a21173e8be4c9be4dbc4b1551132758a61b18df4n/aMirai