Mirai

Malware Family

158 497 indicators of compromise attributed to Mirai across abuse.ch threat intelligence feeds.

Domains

185

IPs

372

URLs

106

Hashes

157 834

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

IndicatorType
peer.saintpetersburgresident.rudomain
cc.xbqpdj.vipdomain
stoplooking2.botlesscucks.stdomain
chickenfriedwatermelonkoolaid.storedomain
tvt.abuse.stdomain
smtp.cope.stdomain
kys.botdealers.stdomain
dd.lumibiki.xyzdomain
ddos.latdomain
ip179.ip-51-89-90.eudomain
cnc.ryanbio.studiodomain
followahahaha.followz.stdomain
ilikecircumcised.comdomain
backupahahahah.followz.stdomain
cnc.504.sudomain
torh3.duckdns.orgdomain
youareall.botlesscucks.stdomain
dcuyypjhxgjppihi.kozow.comdomain
coerece.ilovegaysex.sudomain
report.datasurge.vipdomain
155.103.69.225ip
198.144.179.82ip
141.11.88.129ip
176.65.139.253ip
14.116.219.149ip
46.8.226.50ip
5.230.170.239ip
91.92.42.125ip
205.237.106.27ip
47.86.55.200ip
172.237.61.86ip
2.26.81.46ip
94.154.43.10ip
64.89.163.215ip
172.86.91.224ip
176.65.139.114ip
176.65.139.143ip
8.229.68.116ip
176.65.149.124ip
41.216.189.236ip
http://5.182.210.174/5adf18url
http://5.182.210.174/7c899furl
http://47.239.127.71/lib/xxxurl
http://8.213.214.55/nerv.mipsurl
http://103.83.87.122/telnet.shurl
http://103.83.87.122/iran.mipsurl
http://103.83.87.122/iran.mipselurl
http://103.83.87.122/iran.sh4url
http://103.83.87.122/iran.armv4lurl
http://72.61.196.110:8080/uploadurl
http://89.32.41.16/bins/kla.shurl
http://91.92.40.176:67/sonnet.x86url
http://b.9-9-8.com/t.shurl
http://45.153.34.212:8181/.sugipepulesrlurl
http://boatbeach.online/main_arm5url
http://nova.podril1ak2.online/bins/nova.mipselurl
http://nova.podril1ak2.online/bins/nova.x86_64url
http://nova.podril1ak2.online/bins/nova.i586url
http://api.ddenv.site/mipsurl
http://45.148.10.210/listenerurl