URLhaus Database

You are currently viewing the URLhaus database entry for http://130.12.180.64/nklspc which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry


ID:3740299
URL: http://130.12.180.64/nklspc
URL Status:flame Online (spreading malware for 2 days, 7 hours, 47 minutes)
Host: 130.12.180.64
Date added:2025-12-22 16:35:23 UTC
Threat:Malware download Malware download
Reporter: BlinkzSec
Abuse complaint sent (?): Yes (2025-12-22 16:36:26 UTC to abuse{at}virtualine[dot]org)
Tags:elf mirai link ua-wget

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2025-12-24n/aelf 8231d4e3b4d6385e1eb524ef68bd8c86bcdd3e0290322ac494a08acf30bd126fn/aMirai
2025-12-24n/aelf bd75b8a35466494a86bce636dc875ed18089583c082975cbe5b11b49a9972bcdn/aMirai
2025-12-23n/aelf 40e673fd874001082e92777e53df71e948f3f1f890ce96c751ff9e9df6462aaen/aMirai
2025-12-22n/aelf 2fe9924cd0b8bbbf4c3cca78584fe6fd909efe77897e9ea1b80087028de978d8n/aMirai