🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

URLhaus Database

You are currently viewing the URLhaus database entry for http://wemqmewkqewq.work.gd/arc which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry


ID:3923511
URL: http://wemqmewkqewq.work.gd/arc
URL Status:flame Online (spreading malware for 2 days, 13 hours, 26 minutes)
Host: wemqmewkqewq.work.gd
Date added:2026-09-27 06:34:21 UTC
Threat:Malware download Malware download
URLhaus blocklist:Blocked
Spamhaus DBL :Abused domain (malware)
SURBL :Blocked
Quad9 :Blocked
AdGuard :Not blocked
Cloudflare :Blocked
dns0.eu :Status unknown
ProtonDNS :Blocked
OpenBLD :Blocked
DNS4EU :Not blocked
Reporter: BlinkzSec
Abuse complaint sent (?): Yes (2026-09-27 06:35:27 UTC to abuse{at}swissnetwork[dot]co)
Tags:botnetdomain elf mirai link ua-wget wemqmewkqewq-work-gd

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2026-09-29n/aelf 9908e7cd3a36309fc132ce8600fa4be74acfe449fb068102a39d298d3ba7b554n/aMirai
2026-09-29n/aelf 2822065b1c70159dbc7690a9d74181520a448ffc6737e3cecf31e6c31d83c45en/aMirai
2026-09-28n/aelf 7fd976c5d75164eb14fc1990c9eb570b4b5a97e403474f1bf8f5e5ee4951f1f6n/aMirai
2026-09-27n/aelf 21cda1ff1641725f7f321b4d6261ebea1d10bbd2878bdb60e8a853ba749ef63an/aMirai