URLhaus Database

You are currently viewing the URLhaus database entry for http://31.56.209.222/zero.armv6l which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry


ID:3857197
URL: http://31.56.209.222/zero.armv6l
URL Status:Offline
Host: 31.56.209.222
Date added:2026-06-01 20:45:23 UTC
Last online:2026-06-20 09:XX:XX UTC
Threat:Malware download Malware download
Reporter: tolisec
Abuse complaint sent (?): Yes (2026-06-01 20:46:11 UTC to abuse{at}swissnetwork[dot]io)
Takedown time:18 days, 12 hours, 21 minutes Bad (down since 2026-06-20 09:08:00 UTC)
Tags:elf mirai link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2026-06-10n/aelf d8d40c9213482971b1c2ba8993403e679a3d36453b59fee768a8656ab0305592n/aMirai
2026-06-09n/aelf ad4f66199fb38c2860d8a2dc8f906037e59963bc5691bf5b532f17eefa9d99d6n/aMirai
2026-06-07n/aelf c81cc1ad7a0bcb37236796c1c7927e108e5532810735d6ce0407a2f2302b1e65n/aMirai
2026-06-06n/aelf a09036a91473968b68086eb196bcc50aad781b76d227e2f5eb192a421f5a8a71n/aMirai
2026-06-06n/aelf 58dff621e80964985c00844af20d277ce9f4147a1516232f8171f521ec262dc5n/aMirai
2026-06-01n/aelf 7d7cb34386b8b64fb6b62d01f38a174915b553eccc4d1e77f74b537b1af54f0en/aMirai