URLhaus Database

You are currently viewing the URLhaus database entry for http://31.56.209.222/zero.x86 which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry


ID:3857195
URL: http://31.56.209.222/zero.x86
URL Status:Offline
Host: 31.56.209.222
Date added:2026-06-01 20:45:23 UTC
Last online:2026-06-16 14:XX:XX UTC
Threat:Malware download Malware download
Reporter: tolisec
Abuse complaint sent (?): Yes (2026-06-01 20:46:11 UTC to abuse{at}swissnetwork[dot]io)
Takedown time:14 days, 17 hours, 15 minutes Bad (down since 2026-06-16 14:01:44 UTC)
Tags:elf gafgyt link LeetHozer mirai link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2026-06-10n/aelf 98a0f7ee0e4d814a846e44e27fcd1533e337eb92dd4221a104b6b63162a0ba8fn/aGafgyt
2026-06-09n/aelf fbd3f0376a827e88ee4a883f4f8aa761a00fa7679d760ed1efa2961bd1be925an/aMirai
2026-06-08n/aelf e967d0de271676324123815e847c46ecbeb874e5eda8711761b436f3ae9313d1n/aMirai
2026-06-07n/aelf ee0135b131c627010f7d75721080aec98846da00655a26ef0e2ae856cf7ee77bn/aMirai
2026-06-06n/aelf 4206028d220e9d734d2ff034df454fece28051188ff7628cbb5194fae043f914n/aMirai
2026-06-06n/aelf 6d2607a79a7ae313fc528471e70eb0a726f8e7aa88a8c46bd771aec8bca425acn/aMirai
2026-06-06n/aelf 5a57d14783a0b84d1e302f4d40c2db654480ad53d33d837b42ecedd5377740afn/aMirai
2026-06-01n/aelf ec2743bc10f9207b04b2e96badce4e5f564da05f35e5a06cdc268d4a4f8811f3n/aLeetHozer