URLhaus Database

You are currently viewing the URLhaus database entry for http://scan.504.su/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.x86 which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry


ID:3669666
URL: http://scan.504.su/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.x86
URL Status:flame Online (spreading malware for 3 months, 9 days, 23 hours, 39 minutes)
Host: scan.504.su
Date added:2025-10-12 11:30:10 UTC
Threat:Malware download Malware download
URLhaus blocklist:Blocked
Spamhaus DBL :Abused domain (botnet C&C)
SURBL :Blocked
Quad9 :Blocked
AdGuard :Blocked
Cloudflare :Blocked
dns0.eu :Not blocked
ProtonDNS :Blocked
OpenBLD :Blocked
DNS4EU :Not blocked
Reporter: BlinkzSec
Abuse complaint sent (?): Yes (2025-11-25 07:19:15 UTC to abuse{at}lanedo[dot]net)
Tags:botnetdomain elf mirai link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2026-01-19n/aelf 9496e75825c687aa533f45c1ace274e64e66ff6868dc3629c1c31d77cd5b4d5en/aMirai
2025-12-19n/aelf 0134ba0d82da47549afbf4ff619fe518bf4863eff0f49c939457cbf81c2d15b8n/aMirai
2025-12-19n/aelf fe41937c3b1cf4a2bf8d120e7a16414c85ba458b96f9b637685779c512272c97n/aMirai
2025-12-15n/aelf a011e0d005ffe8f226272d69bf443569abb984e5cbe6fd23a5fa4a53fecae719n/aMirai
2025-12-15n/aelf 74ee95ea935954d8320594f45a3ed34d956637f399d927d75f080648800106a0n/aMirai
2025-11-25n/aelf 06f6c2e48fe50cc39e412f309f22053e06db1aae20c68452dbc0c813bacfaa97Virustotal results 47.69%Mirai
2025-10-12n/aelf 924b4daa3d183fc7d1312a17b68aa952c8d0136918478730cd95623bb1890ed9Virustotal results 56.92%Mirai