URLhaus Database

You are currently viewing the URLhaus database entry for http://ptptonuwu.duckdns.org/bins/xnxnxnxnxnxnxnxnpowerpcxnxn which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry


ID:3696651
URL: http://ptptonuwu.duckdns.org/bins/xnxnxnxnxnxnxnxnpowerpcxnxn
URL Status:flame Online (spreading malware for 1 month, 28 days, 0 hours, 0 minutes)
Host: ptptonuwu.duckdns.org
Date added:2025-11-05 03:54:24 UTC
Threat:Malware download Malware download
URLhaus blocklist:Blocked
Spamhaus DBL :Abused domain (malware)
SURBL :Blocked
Quad9 :Blocked
AdGuard :Not blocked
Cloudflare :Blocked
dns0.eu :Not blocked
ProtonDNS :Blocked
OpenBLD :Blocked
DNS4EU :Blocked
Reporter: BlinkzSec
Abuse complaint sent (?): Yes (2025-12-31 19:53:10 UTC to abuse{at}virtualine[dot]org)
Tags:botnetdomain elf mirai link opendir

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2026-01-01n/aelf 6ed4750e4b02c209861c253bc6cfec44593308a765363e10818d1241c2abe31an/aMirai
2025-12-31n/aelf 8d845789762cbb7ca027fd2f2189d6fa727d8de92fdbda9e36e2deec13f67acbn/aMirai
2025-12-29n/aelf 171bec04821df9d346d7595c452d51040cf0ed5b741f9d5c3773ad305a246b51n/aMirai
2025-11-25n/aelf 3ba0c66de6922d0c00cf3f16afd778356e963c3762e555302c3290f463a73caen/aMirai
2025-11-15n/aelf 6c84264dc1be79229d17f3c4c7f55421ff198acbb1e0a0b892cce76f9d65ba0dn/aMirai
2025-11-12n/aelf f2a4e41a24edc6b077721eb8c247ae62cafee2f62d1a3146327770573efceefan/aMirai
2025-11-05n/aelf 9e5647981fd2d0a93efa242dfaf007bf4c983e2677db31e4f3ac2437db290bacVirustotal results 7.81%Mirai