likedrink.beer: a domain that served 27 Mirai botnet files for routers and other Linux devices, and what to do about it

What likedrink.beer is, and what we know about it

likedrink.beer is not a program on your computer. It is a web address that the abuse.ch project URLhaus lists as a place where malware files were served. We found no public write-up of this one address, so what follows is what URLhaus shows, what our own checks found, and what the sources we read say about Mirai in general.

1. 1

   What URLhaus lists

   Twenty seven file addresses, all in a folder called bins, all named mirai followed by a dot and an ending such as arm5, mips32, x86_64 or rv64. All carry the threat label malware_download and the tag mirai, and all were added on 4 October 2026 between 06:59:22 and 06:59:43 UTC, so within 21 seconds. The reporter name in the data is von. All 27 were marked offline when we read our copy.

2. 2

   What the file names suggest

   The endings look like names of processor types. A botnet author who wants to infect many kinds of devices builds one copy per chip type and puts them all in one folder; a script on a victim device then picks the copy that fits. That is our reading of the names, not something the report says. We did not download any of the files.

3. 3

   What we could not confirm

   We do not know what is inside these files, which Mirai variant they are, where they would report to, or how a device was meant to be tricked into fetching them. URLhaus shows tags, not proof. We also do not know who runs the domain.

4. 4

   What this means for you

   If you saw the name in a firewall log, a router log, a DNS filter or a warning, the name alone does not show an infection. It does show that a device on that network asked for it, or that someone scanned a list. A person normally never types an address like this by hand.

Kind of threat

A server address that handed out 27 files tagged mirai, builds of an IoT botnet program

Where the files were

hxxp://likedrink[.]beer/bins/mirai.NAME: plain http, folder bins, 27 different endings

Domain registered

17 August 2026 through Global Domain Group LLC (RDAP, read 7 October 2026)

Domain status

RDAP lists client hold, client transfer prohibited, server transfer prohibited and inactive. A client hold normally stops the name from resolving

URLhaus entries

27 file addresses, all added 4 October 2026 within 21 seconds, all offline in our copy

Platform

Linux based devices: routers, cameras, recorders, small servers. Not Windows, Mac, iPhone or normal Android apps

What we checked on 11 October 2026, and what we could not

Our check was a plain request from our own server. It did not reach a website: the name could not be found at all (error: getaddrinfo ENOTFOUND). That is consistent with the registry hold, but it clears nothing.

What happened to likedrink.beer, from registration to our check

The domain is under two months old and the reports come in one burst. Dates come from RDAP and from the URLhaus rows in our data; times are UTC.

1. 17 August 2026

   The domain is registered

   RDAP shows likedrink.beer registered on 17 August 2026 at 22:34 UTC through Global Domain Group LLC. The .beer ending is an ordinary public ending, so the name tells us nothing about the operator.

2. 4 October 2026

   27 files are reported in 21 seconds

   Between 06:59:22 and 06:59:43 UTC, 27 file addresses under /bins/ are added, one per chip type, all tagged mirai. Seven were added in the first second. Such speed fits a script that walks through a list of file names, which is our reading and not a statement in the report.

   

3. 7 October 2026

   The registry record shows a hold

   When our database fetched the RDAP record, the status list held client hold, client transfer prohibited, server transfer prohibited and inactive. We do not know who asked for the hold or why.

4. 11 October 2026

   Our request finds no address

   A plain request from our server fails at the name lookup. All 27 files had been marked offline before this. Nothing we hold shows the files online at any time.

What the pattern suggests, and what it does not: a new name, one burst of reports and a hold within three weeks looks like a short lived staging point rather than a long running site. That is our reading of the dates. It does not tell us whether devices were infected from this name during the time it worked.

What Mirai is, in plain words

Mirai is a family of malware for Linux based devices that connect to the internet. The sources we read describe it as one of the first significant botnets aimed at exposed Linux networking devices, and as a program whose published source code led to many variants.

A DDoS attack means that thousands of devices send traffic to one target until it can no longer answer. The owner of an infected camera is therefore usually not the target. Their device is the tool, and its owner pays with a slow connection, a raised bill or a reputation problem if the provider notices the traffic.

How a router or camera ends up asking for these files

The request does not come from a person. A script on a device fetches the file that fits its chip. We cannot say how the first script reached a device for this server; the routes below are the ones the sources and the FTC name.

1. 1

   A device is reachable from the internet

   Home routers, cameras and recorders often have remote management, Telnet or a web login open to the outside. The FTC advises turning off remote management, WPS and UPnP on the router, which are the doors such scans look for.

2. 2

   The login still has the factory password

   The research paper we read describes Mirai trying factory default logins. A device whose admin name and password were never changed lets it in. The FTC says to replace the default admin username and password with unique ones.

3. 3

   A small program is loaded

   Once inside, a script has to fetch a program that fits the device's chip. This is where a folder of 27 builds fits: the script asks for the one that matches. That step is our reading of why the folder exists.

4. 4

   The device joins the botnet

   It then scans for more devices and waits for orders. The owner often notices nothing, or only a slow connection.

Who can meet this, and who cannot

The files are built for Linux on small chips. A normal PC, Mac or phone does not run them. The people at risk are those who own devices that sit on the internet and were never hardened.

What this can cost you

Seeing the name costs nothing. The risks below apply to a device that was actually infected.

• High

  A router under foreign control

  If your router is infected, a stranger runs a program on the box that carries all your traffic. We did not find a source that says a Mirai variant reads that traffic, so we do not claim it, but an unknown program on a router is a reason to reset it.

• Medium

  Your connection used in attacks

  The sources describe infected devices being used for DDoS attacks. Your line carries the attack traffic and can slow down. Your provider may notice.

• Medium

  More scanning from your network

  An infected device scans for other devices, so a second weak device on your network can be found from the first.

• Low

  Nothing, if you only saw the name

  A name in a block list, a log or a warning is not an infection.

What you may notice, and what you may not

Bots are built to be quiet. The signs below are what the facts imply, not a list from one report, and most owners notice nothing.

Start with the question that matters: did a device of yours contact likedrink.beer, or is any device of yours open to the internet with a factory password? None of the checks below deletes anything.

We did not infect a device for this page, and no vendor publishes a removal procedure for these 27 files. The order below follows the FTC's home network advice and is our judgement, not a tested result.

1. 1

   Find which device asked

   If you came here from a log, a router page or an alert, note the device and the time. Only that device is in question, not everything on the network.

2. 2

   Open the router's settings page

   Use the address printed on the router's label or in its manual and sign in. If your password no longer works, treat that as a warning. Look at the list of connected devices and write down any you do not know.

3. 3

   Look for open doors

   Find remote management (also called remote administration), UPnP and WPS. The FTC advises turning off all three on the router unless you need them. The menu names differ from maker to maker, so use the manual of your model.

4. 4

   Check the firmware

   The FTC advises checking the maker's website for firmware updates. If the maker no longer ships updates for your model, the device cannot be made safe by settings alone.

5. 5

   Do the same for cameras and other devices

   Open each camera, recorder or smart device in its app or web page, and see whether the admin login is still the factory one. The FTC says to change any default username and password on each connected device.

6. 6

   A scan helps only a little

   A scanner on a PC cannot look inside a router. A clean result means as little as a clean site test: one data point.