URLhaus Database

You are currently viewing the URLhaus database entry for http://31.56.209.229/zero.armv4l which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry

You are viewing an historical record

While the URL referenced below may have been used by threat actors to spread malware, the URL seems to be clean now and is not serving any malware payload at the moment. Hence this URL / website no longer represents a threat. As a result, URLhaus considers this record as historical. This database entry has not impact on the reputation of the website / domain nor does it appear in any of our blocklists.

ID:	3857831
URL:	http://31.56.209.229/zero.armv4l
URL Status:	Offline
Host:	31.56.209.229
Date added:	2026-06-02 22:04:06 UTC
Last online:	2026-07-02 00:XX:XX UTC
Threat:	Malware download
Reporter:	tolisec
Abuse complaint sent (?):	Yes (2026-06-02 22:05:13 UTC to abuse{at}swissnetwork[dot]io)
Takedown time:	29 days, 2 hours, 21 minutes (down since 2026-07-02 00:26:27 UTC)
Tags:	elf LeetHozer mirai

Payload delivery

The table below documents all payloads that URLhaus retrieved from this particular URL.

Firstseen	Filename	File Type	Payload (SHA256)	VT	Signature
2026-06-21	n/a	elf	20cd4bced2749ad5f2dcfa13a970f90b10b6e0fc464ef6fb9270d6cf67f5ae22	n/a	Mirai
2026-06-06	n/a	elf	1e2b58b266af07f2787710e5fe515a1b90030e23d6f04e24a9edf015052dc55c	n/a	Mirai
2026-06-05	n/a	elf	f7cf64bb5fa4c1102645773b7f880dc34a32fa9aac77f57a017b5bf43abcf344	n/a	Mirai
2026-06-03	n/a	elf	aa4b7113c39803f0bc9bd640a44042e61de370bfe28422935d00a43102d08530	n/a	Mirai
2026-06-02	n/a	elf	8de18340455bffb35a7df9520fb848e61c548fce9eebbccfdb7eee42fd90bd3c	n/a	LeetHozer