URLhaus Database

You are currently viewing the URLhaus database entry for http://196.251.71.105/z/sh4 which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry

You are viewing an historical record

While the URL referenced below has been used by bad actors to spread malware in the past, the malicious content has obviously been removed around 2022-12-20. Hence the the URL / website should no longer represent a threat. As a result, URLhaus considers this record as historical. This database entry has not impact on the reputation of the website / domain nor does it appear in any of our blocklists anymore.

ID:	3588654
URL:	http://196.251.71.105/z/sh4
URL Status:	Offline
Host:	196.251.71.105
Date added:	2025-07-24 01:34:07 UTC
Last online:	2025-07-30 23:XX:XX UTC
Threat:	Malware download
Reporter:	BlinkzSec
Abuse complaint sent (?):	Yes (2025-07-24 01:58:12 UTC to abuse{at}cheapy[dot]host)
Takedown time:	6 days, 21 hours, 9 minutes (down since 2025-07-30 23:07:26 UTC)
Tags:	elf ESP geofenced mirai ua-wget

Payload delivery

The table below documents all payloads that URLhaus retrieved from this particular URL.

Firstseen	Filename	File Type	Payload (SHA256)	VT	Signature
2025-07-26	n/a	elf	4f818e5d00f488cd6859305e96bd29bfb22b1439f870017bd2d4a7460cf3fa3f	n/a	Mirai
2025-07-25	n/a	elf	21867e094fa64ec96dd588397276250184e03e744ef97aaa6c7c01e4c8f85e97	37.50%	Mirai
2025-07-25	n/a	elf	4e91227f3b98a9f9f693878a0301628d7ac062ccf6b5d0eef2a6c6699c020677	46.03%	Mirai
2025-07-24	n/a	elf	4196094ac2c27e10cd642acac3216775dc67b7050ca5eb04cdb6d588d3be815c	n/a	Mirai
2025-07-24	n/a	elf	26a1510e0d8bd1b8916adfe93267b3a59f041f38caf4c46cf9225f711f272a63	51.56%	Mirai