URLhaus Database

You are currently viewing the URLhaus database entry for http://js.byxly.eu.cc/arc which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry


ID:3848946
URL: http://js.byxly.eu.cc/arc
URL Status:flame Online (spreading malware for 9 days, 23 hours, 15 minutes)
Host: js.byxly.eu.cc
Date added:2026-05-17 16:20:11 UTC
Threat:Malware download Malware download
URLhaus blocklist:Blocked
Spamhaus DBL :Abused domain (botnet C&C)
SURBL :Blocked
Quad9 :Blocked
AdGuard :Blocked
Cloudflare :Blocked
dns0.eu :Status unknown
ProtonDNS :Blocked
OpenBLD :Blocked
DNS4EU :Not blocked
Reporter: burger
Abuse complaint sent (?): Yes (2026-05-17 16:21:14 UTC to James{at}22ovz[dot]com)
Tags:mirai link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2026-05-23n/aelf c0c956428141632faa9d55d7a648fd58a0f2e2aeb774c7986a0bd2fb46be21ddn/aMirai
2026-05-23n/aelf a5e66eade1377efff6603b4a636a6fd4acca17d6f3ab875b3a7d2695ee3e21acn/aMirai
2026-05-23n/aelf 92b689d81072611a38b73285951194dfc68df07f554b70176adeef5ab03070ffn/aMirai
2026-05-17n/aelf ff9400d6f811efde411f7491cf415e385c11575e3f525df086578378c1366dd9n/aMirai