URLhaus Database

You are currently viewing the URLhaus database entry for http://5.231.230.158:8888/arm which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry


ID:3834623
URL: http://5.231.230.158:8888/arm
URL Status:flame Online (spreading malware for 3 days, 9 hours, 0 minutes)
Host: 5.231.230.158
Date added:2026-04-29 12:04:27 UTC
Threat:Malware download Malware download
Reporter: BlinkzSec
Abuse complaint sent (?): Yes (2026-04-29 12:05:29 UTC to abuse{at}ghostnet[dot]de)
Tags:5-231-230-158-8888 elf gafgyt link mirai link ua-wget

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2026-04-30n/aelf 8a82c5eeb9187b9debbfe087114ebbfc8adcca04991109155e475f21513ffd2bn/aGafgyt
2026-04-29n/aelf f5857da89c671bd6c813a209d3bcd0ebe9642183f729ff9535e1d8e660ca0850n/aGafgyt
2026-04-29n/aelf 060c70cf43c93ff3abd7c741767790c37da6977a5dc5c78f3f1903ca3cbe5aefn/aMirai