emwqkekwqmekwq[.]work[.]gd: a Mirai botnet download host for Linux routers and IoT devices

Q: Is emwqkekwqmekwq.work.gd safe to open?

No, do not open it, and do not open any path on it. The host was reported for serving malware files, and we did not open them ourselves. A plain page view in a browser is unlikely to harm a normal computer, because the files are Linux programs for embedded chips, but there is no reason to take the chance or to test it. If you want to know whether something on your network contacted it, search your router or firewall logs for the name instead. A web address in a message you did not expect is a reason to delete the message.

Q: Is it a virus on my computer?

Not by itself. The address is where malware was offered, not malware that lives on your PC. The files are ELF files, the program format of Linux, built for the processors in routers, cameras and servers. A phone or an ordinary laptop that only visited a page was not the target. The risk is to devices that can run those files and are reachable from the internet with weak passwords. If you see the name in an antivirus or firewall alert on a computer, read the alert to find out which program made the request and scan that computer.

Q: How do I know if my router or camera is infected?

You cannot tell from one sign. Slow internet, restarts, a changed admin password, an open Telnet port and unknown devices in the router list are reasons to look closer, but each has other causes. The best check is to read the router's connection list and traffic page for a device that sends a lot while idle, to see whether Telnet or remote administration is on, and to search the firewall log for the host name. A quiet result does not clear a device. If the password was a default one and the device faces the internet, clean it anyway.

Q: Can a Linux server be infected from this host?

Yes, it is possible. Twelve of the 31 reported paths are builds for 64 bit x86, the processor type of ordinary servers and virtual machines, so the operator seems to aim at more than small routers. That is our reading from the file names; we did not analyse the files. A server is at risk when it has a weak password on Telnet or SSH, or an unpatched web application. Check running processes, outgoing connections, cron entries and the folders /tmp and /var/tmp. If you cannot explain a finding, rebuild the server from a clean image and change all keys.

Q: Why is the address so long and random?

We do not know why this name was chosen. Long random names are cheap to create, easy to throw away and unlikely to match anyone's block list in advance, which is why operators of malware hosts often use them. That is a general observation, not a fact about this host. The parent name work.gd was registered on 18 June 2022 through the registrar Key-Systems GmbH, according to the registration data our check returned, but the long part is a subdomain with no record of its own that we could read. We do not know who created it.

emwqkekwqmekwq[.]work[.]gd is an address that the abuse.ch URLhaus project listed 31 times on 3 October 2026 as a place where Mirai botnet programs for Linux and IoT devices were offered for download. It is not something you uninstall from a computer: it matters if a router, camera, recorder or Linux server of yours was infected, and the sections below show how to check that and how to clean it.

By Ugnius KiguolisPublished October 7, 2026Updated October 12, 202610 min read

Facts checked October 12, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation.

Automatic

Get a free scan and check if your PC is infected.

Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.

An automatic scan checks installed programs, startup items and browser extensions for anything that came with a download host at emwqkekwqmekwq[.]work[.]gd that URLhaus tags as Mirai.

Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free.

Do it yourself · free Remove Mirai botnet download host (Linux ELF) yourself 5 steps, about 15 minutes, no software needed.

Start the steps

Four step chain: a weak device, a small script, the download host with 31 reported paths, then a bot that scans for more devices — Our own chart of the general Mirai pattern next to what URLhaus recorded for this host. It is not a screenshot of the site: our plain request from our server timed out.

Mirai botnet download host (Linux ELF): summary

Type	A web host listed for distributing Mirai botnet programs (Linux ELF files); not a program on your computer
Risk	High for an exposed router, camera, recorder or Linux server; low for an ordinary computer or phone that only has a browser
Symptoms	Slow connection, restarts, changed settings, open Telnet, unknown processes on a Linux server; none of them proves infection
How to get rid of it	Disconnect, restart, update firmware, factory reset, new password, switch off Telnet and remote admin; rebuild a server if unsure
Our check (12 October 2026)	One plain request from our server timed out; we opened none of the 31 reported files and tested no device
First seen	31 URLs reported to URLhaus within 23 seconds on 3 October 2026; all offline on 12 October 2026
Removal	Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free.

Show 8 more facts

Detection	URLhaus tags: botnetdomain, elf, mirai. Microsoft's name for the original family: Backdoor:Linux/Mirai.A
Registration	Parent name work.gd registered 18 June 2022 (Key-Systems GmbH); no record for the subdomain
Not to be confused with	A website that is hacked, or an infection of your own computer; this is a file server for IoT malware
Name	Emwqkekwqmekwq[.]work[.]gd
Evidence	31 write-ups by security sites; details still limited
Distribution	Typically fake installers, cracked programs, e-mail attachments, fake "verify you are human" pages and ads for popular apps
Damage	Installs other malware, often several programs at once
Facts checked	12 October 2026

Facts checked on 12 October 2026 against Microsoft's entry for Backdoor:Linux/Mirai.A, ThreatFox's page for elf.mirai and our URLhaus data. Two other pages (Cloudflare and CISA) refused our request, so the general Mirai background rests on Microsoft and on search extracts of The Hacker News, SecurityWeek and FortiGuard reports. We ran no sample and tested no device; the cleaning steps are general advice, not tried on a live infection.

What emwqkekwqmekwq[.]work[.]gd is, and what it is not

The address is a web host that served small Linux programs, and the abuse.ch project URLhaus recorded 31 of its file paths as malware downloads tagged elf and mirai. It is a server on the internet, not a program on your computer, so there is nothing named after it to find in a list of installed software.

1
What the reports say
Between 10:49:26 and 10:49:49 UTC on 3 October 2026 one reporter, listed as burger, submitted 31 URLs on this host. Every row carries the same three tags: botnetdomain, elf and mirai. The threat label on every row is malware_download. On 12 October 2026 all 31 rows were marked offline.
2
What Mirai means here
Mirai is the name of a family of botnet malware that takes over internet-connected devices running Linux, such as routers, cameras and recorders. Microsoft describes it as multi-component IoT malware that lets a remote attacker take control of infected devices, which then form a botnet used for distributed denial-of-service (DDoS) attacks. ThreatFox, another abuse.ch project, lists the family as elf.mirai with the alias Katana and 32,138 indicators on 12 October 2026.
3
Who can meet it
People whose router, IP camera, network video recorder, smart device or Linux server is reachable from the internet and has weak or default credentials or an unpatched flaw. A normal laptop or phone that only opened a web page is not the target of these files: they are ELF programs, the executable format of Linux, and they are built for processor types found in embedded devices.
4
What we do not know
The public record we read does not say which devices fetched these files, how many, or who runs the host. It also does not say which exact Mirai variant each file is, because we did not download or run any of them. The sections below mark what is documented and what is our reading.

Address: emwqkekwqmekwq[.]work[.]gd, 31 reported paths, all over plain http
Reported by: URLhaus (abuse.ch), one reporter, 3 October 2026
File type: ELF: Linux program files, one per processor type
Family: Mirai (tag on every row); Microsoft calls the original Backdoor:Linux/Mirai.A
Status of the 31 URLs: Offline on 12 October 2026
Who is at risk: Owners of exposed IoT devices and Linux servers, not ordinary desktop users

What Mirai botnet download host (Linux ELF) does on an infected PC

What we checked on 12 October 2026, and what we could not

Our own check was one plain request from our server to the address, and it timed out. We did not download, open or run any of the 31 files, and we tested no device.

Our check and the public record, 12 October 2026

Listed as a malware download host31 URLs on the host are listed in URLhaus as malware_download with the tags botnetdomain, elf and mirai. All were added on 3 October 2026.
Is it onlineURLhaus marks all 31 as offline. Our plain request from our server on 12 October 2026 ended in a timeout. A timeout can mean the server is gone, that it blocks our server, or that it answers only some visitors, so it tells us nothing safe.
Who runs itUnknown. The public registration record that our check returned is for the parent name work.gd (registered 18 June 2022 through the registrar Key-Systems GmbH, status client transfer prohibited). It is not a record for the long subdomain, and we do not know who created the subdomain.
What the files doNot tested. The tags say Mirai; we cannot say which variant, which commands it uses or where it connects. We rely on Microsoft's description of the original Mirai and on researchers' reports of later variants.
Did anyone get infectedThe reports show files were offered for download, not that any device ran them. We found no public count of victims for this host.
A quiet resultDoes not clear a device. Mirai-type bots often live only in memory and a restart removes them, but the same device can be infected again in minutes if its password is still the default.

Treat the host as hostile, and a device that talked to it as suspect The tags are specific and the whole set of files was reported in 23 seconds, which looks like one operator publishing one batch. That does not prove any device of yours is infected. It means that a device that is exposed to the internet with a default password deserves a check.

How the reports unfolded

The record is short: one burst of reports on one day. The picture shows the reports on a timeline.

Timeline of 31 URLhaus reports for emwqkekwqmekwq.work.gd from 10:49:26 to 10:49:49 UTC on 3 October 2026, with the list of file names by processor type — Our own chart of the URLhaus rows: 31 paths reported within 23 seconds on 3 October 2026, all offline on 12 October 2026.

18 June 2022
The parent name work.gd is registered
Public registration data for the parent name shows this creation date and the registrar Key-Systems GmbH. This is the date for work.gd, not for the long subdomain, which has no record of its own that we could read.
3 October 2026, 10:49:26 UTC
First URLhaus row
The path /b_wt is the first of 31 reported. The other short names in that group are /b_kt, /b_lt and /b_persist.
3 October 2026, 10:49:40 UTC
Thirteen rows in one second
This second holds the most rows, among them /sh4, /armv7l, /m68k, /x86, /powerpc-440fp, /i486, /armv5l and several x86_64 variants.
3 October 2026, 10:49:49 UTC
Last URLhaus row
The path /x86_64_nl closes the batch. The status of every row in our data on 12 October 2026 is offline.
12 October 2026
Our own check
A plain request from our server to the address timed out. We opened none of the files.

What the file names tell us, and what they do not

The names are the part of the evidence that is easy to read. Most are processor names, which is how this kind of host works: a script on a device asks for the file that matches its chip.

Source: the 31 URLhaus rows in our data; readings of the names are ours unless stated. Twelve of the 31 paths target 64 bit x86.
Reported path	What the name suggests	How sure we are
/mips, /mipsel	Build for MIPS processors, common in home routers (big and little endian)	Name only; we did not open the file
/armv4l, /armv5l, /armv6l, /armv7l	Builds for ARM processors of different generations, common in cameras and set top boxes	Name only
/x86, /i486, /i586, /i686, /x86_64	Builds for Intel and AMD processors, 32 and 64 bit. These also run on ordinary Linux servers	Name only
/powerpc, /powerpc-440fp, /sh4, /m68k, /arc	Builds for rarer embedded chips. Researchers reported an ARC build of a Mirai variant called Okiru in January 2018	Name only; the Okiru report is about a different file
/x86_64_nl, _nowd, _clean, _nsr, _dbg, _new, _sr, _t8, _ns, _v2, _fin	Eleven extra versions for 64 bit x86. The suffixes look like labels of variants or tests, such as dbg for debug (our reading)	Meaning not documented
/b_wt, /b_kt, /b_lt, /b_persist	Four short names that are not processor names. b_persist may point to a persistence helper (our reading)	Meaning not documented

The large number of x86_64 files is the unusual part. Mirai grew up on small routers and cameras, but a set of 12 files for 64 bit Intel and AMD suggests the operator also aims at Linux servers and virtual machines. That is a reading from file names, not a finding from an analysed sample.

How a Mirai host is used, step by step

The picture shows the general pattern. Microsoft's description of the original Mirai and researchers' reports of later versions agree on the main steps.

1
Find a weak device
Microsoft's entry for the original Mirai says it uses a SYN scanner to find Telnet services on ports 2323 and 23, then tries about 62 common username and password pairs. Later variants add flaws in specific routers and cameras; a researcher report we read describes exploits against TP-Link devices that use the same download approach.
2
Run a small script
Researchers describe a shell script that is run on the device and tries to download and run files one after another until one matches the device's processor. Scripts named exec.sh and bins.sh are examples in a FortiGuard report. The files then travel over HTTP or TFTP, and the script removes its traces.
3
Fetch the file from a host like this one
The 31 paths reported here fit that pattern: one name for each processor type. The script asks for the name that fits, the host sends an ELF file, and the device runs it.
4
Join the botnet
The infected device connects to its operator, scans the internet for more weak devices and waits for orders. Microsoft says the compromised devices are used for DDoS attacks. Other uses, such as proxying traffic or mining, appear in reports of later variants, and we could not confirm them for this host.

What Mirai botnet download host (Linux ELF) can steal or download

What an infected device can cost you

For most owners the damage is slow service and a bad name on the internet, not stolen documents. The risks below are ordered by how well the sources back them.

High
Your device attacks others
Microsoft says infected devices form a botnet for DDoS attacks. The traffic leaves your connection under your address, and your provider may warn you or cut you off.
High
The device stays under someone else's control
Microsoft describes the original as a backdoor that lets a remote attacker take control. Whatever the device can see on your network may be reachable from it, but we found no source stating what this host's files do beyond that.
Medium
A slow or unstable connection
A bot that scans and floods uses the device's processor and your upload speed. Cameras and routers may freeze or restart. These are ordinary signs with many other causes.
Medium
Re-infection
A restart usually clears a bot that lives in memory, but if the default password and open Telnet remain, scanners find the device again, often within minutes.
Low
Nothing happened
If your device never reached this host, there is no infection from these reports. The reports do not name any victim.

Signs that a device may be infected

None of these signs prove a Mirai infection. They are reasons to look closer, and a device with no signs may still be a bot.

The signs are general ones for IoT botnets; we found no public list of signs for this specific host.
Sign	What it may mean	How to check
Internet slow for no reason, router or camera restarts	The bot is scanning or sending floods	Look at the router's traffic page and its connection list for a device sending a lot while idle
Admin password no longer works, or settings changed	Someone else logged in	Try the web admin page from the local network; reset if you are locked out
Telnet or SSH is open from the internet	The way in for this family	Scan your own address from outside with a trusted port checker, or read the router's remote access page
Unknown programs running on a Linux server, files in /tmp or /var/tmp with odd names	A downloaded ELF file	List processes with ps and check the files they run from
Provider or hosting company sends an abuse notice	Your address was seen attacking	Read the notice for the time and the target port, and match it to your devices

How to check the PC for Mirai botnet download host (Linux ELF)

Start with the devices that face the internet: the router, then cameras and recorders, then any Linux server. All steps here use the device's own menus or standard Linux commands.

1
List what is on the network
Open your router's admin page and look at the list of connected devices. Write down each name and address. Anything you cannot name is the first thing to examine: it can be a camera, a smart plug or a device that is not yours.
2
Check remote access
In the router and every camera or recorder, find the settings for remote administration, Telnet, SSH and port forwarding. Telnet should be off. Remote administration should be off unless you set it up yourself and use a strong password.
3
Check the password
If any device still uses the password printed on its label or a default such as admin, treat it as exposed. Mirai is built on trying lists of default credentials.
4
Look at the firmware
Open the device's firmware or software update page and note the version. Compare it with the latest on the maker's support site. If the maker no longer issues updates, the device cannot be made safe for the internet.
5
On a Linux server, look at processes and connections
Run ps aux and ss -tunp as the administrator. Look for programs you do not know, especially ones started from /tmp, /var/tmp or a user's home folder, and for outgoing connections you cannot explain. Check crontab -l for each user and the files in /etc/cron.d for entries that fetch files with wget, curl or tftp.
6
Check your firewall logs for the host
If your router or firewall keeps logs, search them for requests to the host name and note the time and the local device. A match is a strong sign that device ran a download script. No match does not clear the device: the script may have used an address, not the name.

How to remove Mirai botnet download host (Linux ELF)

How to remove emwqkekwqmekwq[.]work[.]gd

A loader's job is to install other malware, so treat the PC as infected with more than one program until the scans are clean.

1
Step 1: Delete scheduled tasks that bring it back
Open Task Scheduler from the Start menu and click Task Scheduler Library. Select each task you do not recognise and read the Actions tab:
- a task that starts a file in %AppData% or %Temp%
- runs powershell with a long encoded line
- opens a web address belongs to emwqkekwqmekwq[.]work[.]gd or a similar program
Right-click such a task and choose Delete, and check the subfolders too. Leave tasks from Microsoft, your PC's maker and programs you use. Task Scheduler is the same in Windows 11 and Windows 10.
Windows 11: Task Scheduler Library, the task selected, the Actions tab shows the file it runs.
Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 2: Remove it from startup
Whatever emwqkekwqmekwq[.]work[.]gd installed usually starts with Windows. Open Task Manager with Ctrl + Shift + Esc, go to Startup apps in Windows 11 or the Startup tab in Windows 10, and disable what you do not know, starting with entries that have an empty Publisher column.
Open file location on the right-click menu shows the file, which helps you decide and tells you what to delete later. Disabling is safe: if something you need stops working, switch it back on.
Full procedure with screenshots: Stop apps from opening at startup On uGetFix
Step 3: Delete the folders left behind
What the uninstaller leaves behind is usually in the user folders. Open File Explorer, switch on View > Show > Hidden items (in Windows 10 View > Hidden items), and go through %LocalAppData%, %AppData%, %ProgramData% and the two Program Files folders.
Sort by Date modified and delete folders that appeared together with the problem and belong to no program you use. Folders with random names that hold .exe, .dll, .js or .ps1 files are the strongest sign.
Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 4: Scan the PC, then run the offline scan
Open Windows Security > Virus & threat protection > Scan options, run a Full scan and remove everything it finds. Then select Microsoft Defender Antivirus (offline scan) and click Scan now: the PC restarts and scans before Windows loads, which finds files that hide while Windows runs.
Save your work first, because the offline scan takes about 15 minutes. Both scans are built into Windows 11 and Windows 10, and a second scanner from another vendor is a useful extra opinion.
Windows 11: Windows Security > Virus & threat protection > Scan options.
Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 5: Change passwords from another device and sign out other sessions
Assume that the passwords saved in this PC's browsers, and the accounts that were open in them, are known to the attacker. From a phone or a clean computer, change the e-mail password first, then banking, shopping, social and gaming accounts.
Use each service's option to sign out of all other sessions, because stolen cookies keep a session open even after a password change. Turn on two-step verification on each account. Wait with the infected Windows 11 or Windows 10 PC until the scans are clean.
Full procedure with screenshots: Turn on two-step verification / secure a hacked account

Clean a router, camera or Linux server

We did not run these steps on an infected device. They follow the usual advice for IoT botnets and the vendor's own reset instructions; use the maker's manual for the exact menu names of your model.

Five steps in order: find the device, look for signs, unplug and restart, update and factory reset, switch off Telnet and remote admin — Our own chart of the order of actions for an exposed device.

1
Disconnect it from the internet
Unplug the network cable from the router's internet port, or pull the device's own cable. This stops it receiving orders and attacking others while you work. Keep the local network on if you need the admin page.
2
Restart it
Power the device off for at least a minute and on again. Many Mirai-type bots run only in memory, so a restart removes them. That is why a restart alone is not a fix: the device can be taken again as soon as it goes back online.
3
Update the firmware from the maker
Download the newest firmware from the maker's official support page, not from a link in a message or a forum. Upload it in the device's update page. Updating closes the flaws that newer Mirai variants use.
4
Factory reset, then set up again
Use the reset button or the reset option in the admin page, as the manual says. A reset wipes settings and any file placed on the flash storage. Do not restore an old settings backup, because it may bring back a changed setting.
5
Set a new admin password and switch off what you do not use
Choose a long, unique password for the admin page, and a new Wi-Fi password. Turn off Telnet, remote administration and UPnP unless you need them, and do not forward ports to cameras or recorders. If a camera must be viewed from outside, use the maker's cloud service or a VPN to your home network.
6
On a Linux server: stop, remove and rebuild if unsure
Kill the unknown process, delete the file it ran from and remove the cron or service entry that starts it. Change every password and SSH key. If you cannot explain how it got in or cannot be sure all traces are gone, rebuild the server from a clean image. Mirai-type files are small and easy to hide, so a rebuild is safer than cleaning by hand.
7
Replace a device that cannot be fixed
A router or camera with no firmware update and no way to turn off remote access will be found again. Replace it with a supported model, and put cameras and other smart devices on a separate guest network.

If you run a website or server and found this address in your logs

The address may show up in a log, a shell history or a script because someone else put it there. That says your server did something, not that the owner of your site did.

1
Find the command that used it
Search shell history, cron entries, web server logs and application files for the host name. A line such as wget or curl followed by the address is the sign of a download script.
2
Find how it got in
Look at the web server logs just before the first request for the address. Common ways in are an unpatched web application, a weak SSH or Telnet password and an exposed management interface. We found no public report that names the way used by this host.
3
Clean and close the hole
Remove the files, patch the software, change all passwords and keys and, if you are not sure, rebuild from a clean image. Tell your hosting company: they often see the abuse before you do.

After removal: passwords, accounts and prevention

Who to tell

The host is already listed with URLhaus, so one more report from you adds little unless you have something new.

1
If you have a sample or a log
You can submit a URL or a file to abuse.ch (URLhaus for addresses, MalwareBazaar for files), which is what the reporter of this batch did. Do not upload anything that contains your own passwords.
2
If your device was used in an attack
Tell your internet provider after you clean the device, especially if you received an abuse notice. Say what you did, so they can lift any block.
3
If you manage the parent name
Registrars and the operators of shared parent names accept abuse reports. We do not know who runs work.gd or whether it hands out subdomains, so we do not name a contact.

Keep your devices out of botnets

Mirai relies on default passwords and exposed services. Removing both removes most of its chance.

Change the default admin password of every router, camera and recorder the day you install it.
Turn off Telnet and remote administration. Use SSH with keys on servers.
Install firmware updates, and check for them every few months.
Put cameras and smart devices on a guest or separate network.
Buy devices from makers that publish security updates.
Keep a list of your devices so an unknown one is easy to see.

Don't

Do not forward ports from the internet to a camera or recorder.
Do not keep the password printed on the label.
Do not trust a restart as a fix.
Do not download firmware from links in messages.
Do not leave a device whose maker has stopped updates on the internet.

Questions about Mirai botnet download host (Linux ELF)

What is emwqkekwqmekwq.work.gd?

It is an internet address that URLhaus, a project of abuse.ch, listed 31 times on 3 October 2026 as a place offering malware downloads. Every row is tagged botnetdomain, elf and mirai, which means Linux program files for the Mirai botnet family.

It is a server, not a program on your computer, so there is nothing to uninstall. The reports do not say who runs it or how many devices fetched the files. All 31 URLs were marked offline on 12 October 2026, and our own request from our server timed out, which proves nothing either way.

Is emwqkekwqmekwq.work.gd safe to open?

No, do not open it, and do not open any path on it. The host was reported for serving malware files, and we did not open them ourselves.

A plain page view in a browser is unlikely to harm a normal computer, because the files are Linux programs for embedded chips, but there is no reason to take the chance or to test it.

If you want to know whether something on your network contacted it, search your router or firewall logs for the name instead. A web address in a message you did not expect is a reason to delete the message.

Is it a virus on my computer?

Not by itself. The address is where malware was offered, not malware that lives on your PC. The files are ELF files, the program format of Linux, built for the processors in routers, cameras and servers.

A phone or an ordinary laptop that only visited a page was not the target. The risk is to devices that can run those files and are reachable from the internet with weak passwords.

If you see the name in an antivirus or firewall alert on a computer, read the alert to find out which program made the request and scan that computer.

What is Mirai?

Mirai is a family of malware that turns internet-connected Linux devices into a botnet. Microsoft describes it as multi-component IoT malware that lets a remote attacker control infected devices, and it says Mirai finds devices by scanning for Telnet on ports 2323 and 23 and trying about 62 common username and password pairs.

The infected devices are used for DDoS attacks, which flood a target with traffic. Microsoft published its entry on 19 October 2016. Researchers have since reported many variants, and ThreatFox listed 32,138 indicators for the family on 12 October 2026.

How do I know if my router or camera is infected?

You cannot tell from one sign. Slow internet, restarts, a changed admin password, an open Telnet port and unknown devices in the router list are reasons to look closer, but each has other causes.

The best check is to read the router's connection list and traffic page for a device that sends a lot while idle, to see whether Telnet or remote administration is on, and to search the firewall log for the host name.

A quiet result does not clear a device. If the password was a default one and the device faces the internet, clean it anyway.

How do I remove Mirai from a router or IoT device?

Disconnect the device from the internet, restart it, update the firmware from the maker's official page, then do a factory reset and set up again with a new admin password. Turn off Telnet, remote administration and UPnP, and do not forward ports to it.

A restart alone often removes a bot that lives in memory, but the device will be infected again if the default password and open service remain. If the maker no longer issues updates, replace the device. We did not test these steps on an infected device; use the maker's manual for the exact menus.

Can a Linux server be infected from this host?

Yes, it is possible. Twelve of the 31 reported paths are builds for 64 bit x86, the processor type of ordinary servers and virtual machines, so the operator seems to aim at more than small routers. That is our reading from the file names; we did not analyse the files.

A server is at risk when it has a weak password on Telnet or SSH, or an unpatched web application. Check running processes, outgoing connections, cron entries and the folders /tmp and /var/tmp. If you cannot explain a finding, rebuild the server from a clean image and change all keys.

Why is the address so long and random?

We do not know why this name was chosen. Long random names are cheap to create, easy to throw away and unlikely to match anyone's block list in advance, which is why operators of malware hosts often use them. That is a general observation, not a fact about this host.

The parent name work.gd was registered on 18 June 2022 through the registrar Key-Systems GmbH, according to the registration data our check returned, but the long part is a subdomain with no record of its own that we could read. We do not know who created it.

Does a restart or an antivirus scan clear a Mirai infection?

A restart often removes a Mirai bot that lives only in memory, but it does not remove the cause. If the device keeps its default password and open Telnet, scanners find it again, sometimes within minutes. Routers and cameras do not run an antivirus, so the real fix is firmware update, factory reset and a new password.

On a Linux server, an antivirus scan can help but a quiet result does not clear it, because the files are small and easy to hide. If you are unsure how the server was entered, rebuild it from a clean image.

Will Fortect remove emwqkekwqmekwq[.]work[.]gd?

Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.

For emwqkekwqmekwq[.]work[.]gd, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.

Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.

Sources

Microsoft Security Intelligence: Backdoor:Linux/Mirai.A threat description (published 19 October 2016) (read October 12, 2026)
abuse.ch ThreatFox: malware family elf.mirai (alias Katana, 32,138 indicators) (read October 12, 2026)
The Hacker News: Mirai Okiru botnet targets ARC-based devices (January 2018) (read October 12, 2026)
SecurityWeek: Cross-platform Mirai variant leverages open source project (read October 12, 2026)
FortiGuard Labs: Botnets continue exploiting CVE-2023-1389 for wide-scale spread (repost) (read October 12, 2026)