URLhaus Database

You are currently viewing the URLhaus database entry for http://91.239.211.89/bins/kworkerd-scsi which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry


ID:3868025
URL: http://91.239.211.89/bins/kworkerd-scsi
URL Status:flame Online (spreading malware for 5 days, 9 hours, 2 minutes)
Host: 91.239.211.89
Date added:2026-06-20 05:58:09 UTC
Threat:Malware download Malware download
Reporter: abuse_ch
Abuse complaint sent (?): Yes (2026-06-20 05:58:19 UTC to absue{at}versionblue[dot]de,report{at}abuseradar[dot]com)
Tags:ua-wget

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2026-06-25n/aelf ffc42d1e02a187a39ce83e1566963becca5cda678cfb6699c48d5af69a35f998n/a
2026-06-21n/aelf e3c75454d745d76a0e155891e294a02284a0fc2835acf44c68428ad5d6c2e0d3n/a
2026-06-20n/aelf 97ab95191daea05b15024ff2a3a52081a30d4238ba4db4efad5e232f44ab97abn/a
2026-06-20n/aelf af4766e3258253c3318678d5441400e6a908e2b787ad1a20a990df0e4eab111bn/a