iloveanal.work.gd: a download server for Mirai botnet files, and what to do if your router or camera fetched them

What iloveanal.work.gd is, and what we know about it

iloveanal.work.gd is not a program on your computer. It is a web address, a subdomain of work.gd, that the abuse.ch project URLhaus lists as a place where Mirai botnet files were served. We found no public write-up of this one address, so what follows is what URLhaus shows, what our own request found, and what is published about Mirai in general.

1. 1

   What URLhaus lists

   Thirty-one file addresses on iloveanal.work.gd, all on plain http and all in the root folder of the site. They were added within about fifteen minutes on 3 October 2026: 30 between 10:34:22 and 10:34:39 and the last one, b_persist, at 10:49:40. All carry the threat label malware_download and the tags botnetdomain, elf and mirai. The reporter is a single account named burger. At the time we read the data, every one of the 31 was marked offline.

2. 2

   What the tags mean

   ELF is the program file format of Linux and of the many small systems built on it, such as routers, IP cameras, video recorders and set-top boxes. Mirai is the name of a botnet family whose source code became public in 2016, so many people run their own copies. Botnetdomain is a tag that says the address belongs to the infrastructure of a botnet. The three tags together say: this host serves programs for a Mirai type botnet.

3. 3

   What the file names suggest

   Most names are processor types: x86_64, i486, i586, i686, armv4l, armv5l, armv6l, armv7l, mips, mipsel, m68k, sh4, powerpc, powerpc-440fp and arc. Others carry a suffix such as dbg, ns, sr, nsr, nowd, nl, fin, t8, v2, new, clean, lt, kt, wt or persist. We did not open the files, so what the suffixes mean is our reading: variants of the same program for different devices or settings. A script on a hacked device picks the one that matches its processor.

4. 4

   What we could not confirm

   We did not download any file, so we cannot tell you which Mirai build it is, which address it reports to or what attacks it can start. URLhaus shows tags, not a proof. We also do not know how the attacker got onto the first devices. That step happens elsewhere and is not visible from a download server.

5. 5

   What this means for you

   If the name only turned up in a firewall log, a DNS block list or a warning, you are not infected by that alone. The risk is for a device on which something already ran and then went to this address to fetch a matching file. A person with a browser has no reason to request these files.

Kind of threat

A server serving Linux ELF files tagged mirai, a botnet that turns routers, cameras and other devices into attack machines

Where it is listed

URLhaus (abuse.ch), 31 URLs, all added on 3 October 2026, all offline when we read the data

Shape of the address

A subdomain of work.gd. work.gd was registered on 18 June 2022 through the registrar Key-Systems GmbH. That date is for the parent domain, not for this subdomain

Who can meet it

Owners of Linux based devices with a weak or default password, an old firmware or an open remote login. Not a normal Windows PC or Mac

On a Windows PC or Mac?

An ELF file does not run there. A PC in the same network is not infected by these files, but it may be used to reach a hacked device

On a phone?

Android is built on Linux, but these files are listed as ELF programs for routers and small systems, and nothing we read says phones are a target

What we checked on 13 October 2026, and what we could not

Our check was one plain request from our server to the address. It did not answer before the time limit. That is the whole result of our own test, and it clears nothing.

How the reports came in, on 3 October 2026

All 31 reports fall into one quarter of an hour. That pattern is typical of one automated collector finding an open folder and listing everything in it.

1. 18 June 2022

   work.gd is registered

   The registration record of work.gd shows 18 June 2022 as the creation date, with Key-Systems GmbH as registrar. Nothing links this date to the later reports.

2. 3 October 2026, 10:34:22

   The first files are listed

   Within the first second, URLhaus lists x86, i586, b_wt, armv5l and x86_64_new. The folder looks like a directory of ready made builds.

3. 3 October 2026, 10:34:33 to 10:34:39

   The rest of the folder follows

   Over the next seconds the list grows with armv4l, armv6l, armv7l, mips, mipsel, m68k, sh4, powerpc, arc and the x86_64 variants. By 10:34:39 there are 30 entries.

4. 3 October 2026, 10:49:40

   b_persist appears

   A last file, b_persist, is added fifteen minutes later. It is the only one that arrived separately. We do not know what its name stands for; the word is our hint that it may be a build meant to stay on the device, but we have not seen the file.

5. 13 October 2026

   No answer to our request

   A plain request from our server timed out. At the time we read the data, URLhaus marked all 31 addresses offline.

What Mirai is, in plain words

Mirai is a family of malware for Linux based devices. It was first found in August 2016 by the research group MalwareMustDie, and its source code was published on a hacker forum in October 2016. After that, anyone could build a botnet of their own, which is why the tag mirai covers many unrelated operators.

1. 1

   How it finds devices

   An infected device scans the internet for others, probing the remote login ports Telnet 23 and 2323. When a device answers, the malware tries a list of more than 60 factory default user name and password pairs. When one works, the device is reported to a collection server and then infected.

2. 2

   Which devices

   It mainly targets consumer devices that run Linux: IP cameras, home routers, video recorders. Later copies were built for ARM, MIPS, x86 and PowerPC processors, and one variant, Okiru, was the first to target ARC based devices. That range is why a download server keeps a file for every processor type, as this one does.

3. 3

   What an infected device does

   It usually keeps working, perhaps slower, with more network traffic. It joins the botnet and takes part in floods of traffic against a victim chosen by the operator. It also removes competing malware and blocks the remote login ports, so that nobody else takes the device.

4. 4

   Why a reboot is not enough

   A restart removes the running program, because it lives in memory. If the password has not been changed, the device is usually infected again within minutes, since scanners are always looking. That is why the order of the steps below matters.

5. 5

   Descendants

   Later botnets reused its code, among them Satori in December 2017, Okiru and Masuta in January 2018, and Aisuru from 2024. Some added exploits for particular routers and recorders, so a strong password helps, but updates matter as well.

What security products call files like these

We did not scan the files, so we have no detection name for them. The names below are the ones the Trend Micro encyclopedia lists for other Mirai samples, and they show the pattern, not the result for this server.

The danger is mostly to the device and to other people, and less to your files. A hacked router or camera is usually used as a tool, not read like a diary.

• High

  A device in a botnet

  An infected device sends floods of traffic at victims chosen by someone else. Your address may then be reported for attacks you did not know about.

• High

  A router that someone else controls

  If the router itself is infected, every device behind it passes through it. Check its DNS settings and admin account after cleaning.

• Medium

  A slow connection

  Heavy traffic from the device can slow the home network or push up the bill of a metered line.

• Medium

  Reinfection

  While the default password is still in place and the login port is open, scanners find the device again within minutes.

• Low

  The files themselves on a PC

  An ELF file does not run on Windows or macOS. Downloading one by mistake does not infect the computer.

How a device ends up asking for these files

No source tells how this server was used. These are the routes public sources describe for Mirai in general.

1. 1

   A default or weak password on Telnet or SSH

   The classic route. A device with remote login open to the internet and a factory password is found by scanners and logged into. The malware then runs a short command that downloads and starts the file for its processor.

2. 2

   A known flaw in the web interface

   Later botnets added exploits for particular routers, recorders and web frameworks. A device without recent firmware can be taken over with no password guessing.

3. 3

   A device that was already infected

   Infected devices scan others and push the download command. A device behind a router with an open port is exposed whatever its own settings are.

4. 4

   A server you run yourself

   A Linux server with a weak password or an old web application can receive the same command. Cloud servers show up in reports as well, not only home devices.

Often the only visible sign is a device that is slow or a provider warning about abuse from your connection.

Check your devices before you change anything

Start with the question of whether any of your devices ever contacted this name. Your router or DNS log is the best place to look, not the PC.

1. 1

   Search your logs for the name

   Open the admin page of your router, then its log or DNS history, and search for iloveanal and work.gd. Some routers, Pi-hole and similar tools keep such a list. No entry means this check found nothing. It does not clear a device, because many routers keep no log.

2. 2

   List what is on the network

   In the router's page of connected devices, write down every name and address. Look for devices you do not know, and for cameras and recorders you forgot.

3. 3

   Look at open remote login

   In the router, look for Remote management, Telnet, SSH or port forwarding to a device. If you did not turn them on, switch them off. Telnet on the internet has no good reason today.

4. 4

   Look at unusual load

   A device that is hot, slow, or sends much more data than usual is worth a closer look. The router's traffic page often shows it.

5. 5

   On a Linux device you can log into

   List running processes and check the folders /tmp, /var/tmp and /dev/shm for files you did not put there; Mirai type programs are known to run from such places. We did not test this against these files, so a clean listing proves nothing.

6. 6

   Ask your provider

   If your internet provider sent an abuse notice, it names the date and the target. That helps to find which device was the source.

How to clean a router, camera or Linux server

The order matters: cut it off from the internet, change the password, update, only then reconnect. We did not run these steps against a live infection; they follow the public descriptions of Mirai and the makers' own help pages for your device.

1. 1

   Unplug it from the internet

   Pull the network cable of the camera or recorder, or switch off the router's internet connection. This stops it from taking part in attacks while you work.

2. 2

   Restart it

   A power cycle removes the running malware, because it sits in memory. Do not reconnect yet, since a restart without the next step usually ends in a new infection.

3. 3

   Set a new, long password

   Sign in on the local network and change the admin password to a long one that you use nowhere else. Change the password of any other account the device has, and delete accounts you do not know.

4. 4

   Update the firmware

   Download the newest firmware from the maker's own site and install it. If the device is no longer updated by its maker, it is a long term risk and should be replaced.

5. 5

   Do a factory reset if you are unsure

   A factory reset wipes settings, so set the password first, then restore only what you need. Write the settings down before you reset.

6. 6

   Turn off what you do not use

   Disable Telnet, remote management, UPnP and port forwards you did not make. Put cameras and recorders behind the router without a direct path from the internet.

7. 7

   On a Linux server

   Rebuild from a known clean image if you can. If not, find and remove the unknown files and cron jobs, change every password and SSH key, update the packages and close the open ports. We cannot give exact steps for your distribution; use its own documentation.

8. 8

   Watch it for a week

   Check the router's traffic page and log. If the device behaves badly again, it was infected again or the cause is still there. Replace it.

What to do on a Windows PC or a Mac

The files on this server are ELF files, which do not run on Windows or on macOS. A PC does not need removal steps for them, but it may have been the way in, or sit on a network with a hacked device.

1. 1

   If you clicked or downloaded one

   Delete the file. It cannot start by itself on Windows or macOS. Run a normal scan with the built in protection, Windows Security or the Mac's own checks, as a precaution.

2. 2

   If the PC logs into devices

   Change passwords you keep for routers, cameras or servers if they were saved on that PC, in case the PC was the source of a leak.

3. 3

   If your PC is slow

   The cause is more likely something else. A Mirai file would not run on it. Use the usual checks for Windows or Mac and look at the router in parallel.