c2.teamzeroday.net: a Mirai botnet host that offered manta files for routers and other small devices, and how to clean one

What c2.teamzeroday.net is, and what the reports show

c2.teamzeroday.net is not something you install. It is a host name that the abuse.ch project URLhaus lists for eleven Mirai files offered over plain http. We found no researcher write-up about this host or about the name manta, so this page puts together the URLhaus rows, the registration record, our own request and what CISA, the FBI, HKCERT, Akamai and others have published on Mirai.

1. 1

   The eleven files

   All sit in a folder called bin and share the name manta with a processor ending: armv6l, armv7l, aarch64, x86_64, i686, mips, mipsel, ppc, sh4, m68k and arc. URLhaus received them from the reporter BlinkzSec on 1 October 2026 between 13:48:15 and 13:48:34 UTC.

2. 2

   The four tags

   Every file has the same four tags: elf, which is the program format of Linux; mirai, the malware family; ua-wget; and the host name itself. Our reading of ua-wget is that the reporter fetched the files with the wget tool, the way an infected device would, possibly because the server answered only that kind of request.

3. 3

   The host name

   c2 is the common short form of command and control, the server that gives a botnet its orders. A download folder on a host called c2 suggests the same operator used the name for both jobs, but we did not see any control traffic and cannot confirm it.

4. 4

   What we cannot tell you

   We did not fetch the files, so we do not know which Mirai variant manta is, which attack commands it carries or which device flaw was used to spread it. Manta does not appear as a family name in any report we read.

Kind of threat

A download host for Mirai builds: the files a hacked router, camera or other Linux device fetches to join a botnet

Where the files were

hxxp://c2[.]teamzeroday[.]net/bin/manta.<processor>, eleven builds

Domain registered

teamzeroday.net on 20 September 2026 through NICENIC International Group Co., Limited; status client delete prohibited and client transfer prohibited (RDAP, read 8 October 2026)

URLhaus entries

11 file addresses, all on 1 October 2026, all tagged elf, mirai and ua-wget; all offline in our copy on 8 October 2026

Our check

8 October 2026: HTTP 521 from Cloudflare, meaning the server behind Cloudflare refused the connection

Platform

Linux devices with these processors: routers, IP cameras, recorders, some TV boxes and small servers. Not Windows, macOS or iPhone

What our request on 8 October 2026 found

We sent one plain request from our server, with no browser and no clicks.

It reached Cloudflare, which fronts the name, but not the machine behind it.

From registration to error page in eighteen days

The public record of this host is short.

Every date below comes from RDAP, URLhaus or our own request.

1. 20 September 2026

   The domain is registered

   RDAP shows teamzeroday.net created at 11:59 UTC through NICENIC International Group Co., Limited, with locks against deletion and transfer that the registrar sets on request.

2. 1 October 2026, 13:48 UTC

   Eleven builds are reported

   BlinkzSec reports manta.armv6l first at 13:48:15 UTC and manta.ppc, manta.arc and manta.armv7l last at 13:48:34 UTC. All eleven are tagged elf, mirai and ua-wget.

3. By 8 October 2026

   The files go offline

   Our copy of the URLhaus data marks every file offline.

4. 8 October 2026

   Our request

   Cloudflare answers with error 521: the server behind the name refuses the connection. No page and no file comes back.

What this suggests: a fresh domain, a full shelf of builds and a quick disappearance is a pattern Spamhaus and Pulsedive describe for botnet infrastructure that keeps moving. It does not tell us how many devices were enrolled while the files were up.

How a router ends up fetching manta files

Nobody downloads these files on purpose.

A script running on a hacked device does it, usually seconds after the break in.

1. 1

   The break in

   Bots try default passwords over Telnet, which CISA says gave the original Mirai hundreds of thousands of devices, or send a known exploit. Akamai reported in April 2026 a campaign that used CVE-2025-29635, a command injection flaw in D-Link DIR-823X routers retired in September 2025.

2. 2

   A move to a writable folder

   In the Akamai sample the injected command moves to a folder the device can write to, such as /tmp, /var/run, /mnt, /root or the top folder.

3. 3

   The download

   The device then tries busybox wget, curl, tftp and ftpget in turn to fetch a shell script, makes it executable and runs it. Symantec found that such a script downloads every build and runs each one until one fits the chip.

4. 4

   The bot starts

   Only the matching build runs. Akamai's tuxnokill sample hid its strings with a simple XOR key and printed a fake crash message to look harmless.

5. 5

   The device takes orders

   The bot connects to its controller and waits. Akamai lists flood methods over TCP, UDP, GRE and HTTP. Between attacks the bot looks for more devices to infect.

Why there are eleven files, and which devices each one fits

A botnet operator cannot know in advance what chip a hacked device has, so the server offers every common one.

The endings are the clue to which of your devices could be at risk.

Mirai in 2026: an old family with many new names

Mirai's code has been public for ten years, which is why a new name like manta can appear without any new research behind it.

Mirai does not go after your photos or passwords.

It borrows your device and your internet line, and that has its own price.

• High

  A router in someone else's hands

  Whoever controls the router sits in front of every device in the home. Mirai uses it for floods, but the hole it came through stays open to others.

• High

  A device that will never be fixed

  Akamai notes the D-Link routers in its campaign were retired in September 2025. Such a device can be cleaned by a restart and taken again minutes later.

• Medium

  Slow internet and a burned address

  Flood traffic eats your upload, and an address seen in attacks can land on block lists, so some sites start to refuse or challenge you.

• Medium

  Cameras and recorders

  Mirai itself does not watch video, but the weak password or flaw that let it in can also let a person in.

• Low

  Windows PCs, Macs and iPhones

  These files are Linux programs for small devices. They do not run on those systems.

• Low

  A name in a log

  A blocked request or a block list entry is not an infection by itself.

Where people see the name c2.teamzeroday.net

Almost everyone who searches for this name saw it in a tool, not on a web page.

1. 1

   In a router or DNS filter log

   Home routers with security features, Pi-hole style DNS filters and firewalls log blocked names. An entry means a device asked for the name; the log shows which device and when.

2. 2

   In a warning from your provider

   Internet providers sometimes write to customers whose line sends attack traffic. Ask them for the time and kind of traffic so you can match it to one device.

3. 3

   On a server you run

   On a Linux server, the name may show up in shell history, in a cron entry or in a web log next to a wget or curl command. That is a sign someone ran commands on the machine.

4. 4

   In a threat feed or block list

   Security teams see it in feeds such as URLhaus. If it is only there, nothing on your side touched it.

Find and check the device that asked

Begin with the log entry. Note the local address of the device and the time of the request, then match it to a device on your router's list of connected clients.

If the device turns out to be a Windows PC, it is not running these Linux files, but something on it made the request; use the plan further down this page for that PC.

1. 1

   Match the address to a device

   Open the router's admin page and its list of connected devices. The local IP or MAC address from the log leads to a name such as a camera, a TV box or the router itself.

2. 2

   Read the router's settings

   Look at remote management, port forwarding, UPnP, DNS servers and the admin user list. Write down every setting you did not make; the FBI names changed settings as a sign of compromise.

3. 3

   Check the model's support status

   Find the exact model on the maker's support site. If it is marked end of life or the newest firmware is years old, plan to replace it.

4. 4

   On a Linux server, look for traces

   Look in /tmp, /var/run and /mnt for files named manta or with processor endings, and in shell history, cron and web logs for wget, curl, tftp or ftpget commands you did not run. Akamai's sample used exactly those folders and tools.

5. 5

   Do not trust a normal look

   Mirai runs from memory and often renames itself. A router page or process list that looks normal is not proof of a clean device.