URLhaus Database

You are currently viewing the URLhaus database entry for http://ptptonuwu.duckdns.org/bins/xnxnxnxnxnxnxnxnmipsxnxn which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry


ID:3696649
URL: http://ptptonuwu.duckdns.org/bins/xnxnxnxnxnxnxnxnmipsxnxn
URL Status:flame Online (spreading malware for 1 month, 28 days, 8 hours, 28 minutes)
Host: ptptonuwu.duckdns.org
Date added:2025-11-05 03:54:13 UTC
Threat:Malware download Malware download
URLhaus blocklist:Blocked
Spamhaus DBL :Abused domain (botnet C&C)
SURBL :Blocked
Quad9 :Blocked
AdGuard :Not blocked
Cloudflare :Blocked
dns0.eu :Not blocked
ProtonDNS :Blocked
OpenBLD :Blocked
DNS4EU :Blocked
Reporter: BlinkzSec
Abuse complaint sent (?): Yes (2025-12-31 18:14:10 UTC to abuse{at}virtualine[dot]org)
Tags:botnetdomain elf mirai link opendir

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2026-01-01n/aelf 344bf6641f112d9ad20b21d0199f70e355a019843cda4038e651ce34be11ff46n/aMirai
2025-12-31n/aelf a0c072c5c3dee6d5b1b48815d6a8e1ed34d447c98e6ec344e6cbed193179adfen/aMirai
2025-12-29n/aelf e1cfdd461d310ea6e9b2ee5c06cf774c474156d2611283845bb6de52bcfc4896n/aMirai
2025-11-25n/aelf a26425304033bc85f9edb81f75f4a1799d69b8f1b1b8f4fdc2ee5cef6e8a378dn/aMirai
2025-11-15n/aelf b45801d1c9bb5d31913f3c6d1bd83db4412014dd13b9f2e81719422e1d1b9ec1n/aMirai
2025-11-12n/aelf cbada6601d85cec73726566a544b3a9d9ad619d7b8c768123737115bbddf8afcn/aMirai
2025-11-05n/aelf 23e8188ff6a5422aa9a12a008406d166d10ceb6f5db08183acbd65a6898d3e7eVirustotal results 17.19%Mirai