melonandworld.top: a domain that served Linux botnet programs for routers and smart devices, and what to do if one of your devices fetched them

What melonandworld.top is, and what we know about it

melonandworld.top is not a program on your computer. It is a web address that the abuse.ch project URLhaus lists as a place where malware files were served. We found no public write up of this one address, so what follows is what the URLhaus rows show, what our own server saw, and what published research says about the same pattern of files.

1. 1

   What URLhaus lists

   Fourteen file addresses on melonandworld.top, all plain http, all added on 15 October 2026 between 18:52 and 19:07 UTC by one reporter. Thirteen sit in a folder called hiddenbin and are named Space followed by a chip type: arm, arm5, arm6, arm7, arc, m68k, mips, mpsl, ppc, sh4, x86, x86_64 and i686. The fourteenth is a shell script, 1.sh, in the top folder. Every row carries the threat label malware_download. When we read our copy of the data, all 14 were marked offline.

2. 2

   What the tags mean

   elf marks a program file for Linux and similar systems. sh marks a shell script. ua-wget means the file was fetched with the download tool wget, which is built into most Linux and router firmware. botnetdomain is a tag we could not find defined on an official abuse.ch page; our reading is that the domain is used as botnet infrastructure. No row carries a malware family name, so we do not name one. We do not say this is Mirai, Gafgyt or anything else.

3. 3

   What we could not confirm

   We did not download any of the files, so we cannot tell you what is inside them, where they report to, or which devices they run on in practice. URLhaus shows tags, not proof. We also do not know how a device first came to ask for 1.sh. That first step is not visible from the server side.

4. 4

   What this means for you

   If you only saw the name in a firewall log, a DNS block or a warning, you are not infected by that alone. The risk is for a device where something already ran and went to fetch these files. A normal visitor with a browser has no reason to request them, and a Windows PC cannot run a Linux ELF file as it is.

Kind of threat

A domain that served a shell script and 13 Linux programs, one per chip type, tagged botnetdomain, elf, sh and ua-wget

Where the files are

hxxp://melonandworld[.]top/1.sh and hxxp://melonandworld[.]top/hiddenbin/Space.<chip>: plain http on the normal web port

Domain registered

9 August 2026 through Global Domain Group LLC, status client transfer prohibited (RDAP, read 15 October 2026)

URLhaus entries

14 file addresses, all added 15 October 2026; all 14 marked offline in our copy of the data

Platform

Linux based devices: routers, cameras, recorders, NAS boxes, small servers. The chip names (arm, mips, ppc, sh4, m68k, arc) are those of embedded hardware

Family

Not stated in the rows. We do not name one

What we checked on 17 October 2026, and what we could not

There is no screenshot of a site here. Our check was one plain request from our server to melonandworld.top on 17 October 2026, and it did not get an answer: the name could not be resolved (error ENOTFOUND). That clears nothing, because the reports are two days old and the name may have been removed, suspended or moved.

What happened to melonandworld.top, from registration to our check

The domain is about two months old. All 14 reports were filed within 15 minutes on one day. The dates come from RDAP and from the URLhaus rows we hold; times are UTC.

1. 9 August 2026

   Domain registered

   RDAP shows melonandworld.top registered on 9 August 2026 at 17:14 UTC through Global Domain Group LLC. The only status is client transfer prohibited, a common lock that stops the domain being moved by accident. It says nothing about who runs it.

2. 15 October 2026, 18:52

   Twelve Space programs reported in 22 seconds

   Between 18:52:17 and 18:52:39 URLhaus received twelve programs: Space.mpsl, arm5, m68k, x86_64, sh4, mips, ppc, arm7, arc, arm6, i686 and x86. Such a tight burst fits a script or a person walking through a folder listing, but the rows do not say which.

   

3. 15 October 2026, 19:07

   The shell script and the last program

   At 19:07:20 the shell script 1.sh was added, and at 19:07:22 the thirteenth program, Space.arm. The script is the file a device would fetch first; the programs are what it would then choose between.

4. 17 October 2026

   Our request does not resolve

   Our server could not find the address of melonandworld.top. We keep the guide as it is and will add a dated line if new reports appear.

The 14 files, one by one

The file names are the most useful clue in the data: a program that exists in 13 builds is built to run on whatever device it lands on. Chip names below follow common usage; they are our reading of the file names, not something URLhaus states.

The SANS Internet Storm Center describes the same pattern for another campaign: a shell script works out the architecture of the victim device and then downloads the matching build, with a list that includes mips, mpsl, x86, arm, arm5, arm6, arm7, sh4, ppc and arc. That is the same list as the file names here. It shows how such a set is used, not that this domain belongs to that campaign.

What programs like this usually do, and what we cannot say about these

We did not open the files, so nothing in this chapter is a finding about them. It is what published research says about the kind of script and programs this naming points to, and it is marked as such.

What this can cost you

The harm depends on whether a device of yours fetched and ran a file. The list below is ranked by how likely each risk is for an infected router, camera or small server.

• High

  Your device used to attack others

  A bot does work for a stranger: sending floods of traffic at a target. Your internet address may end up in the target's logs and on block lists, and your line can slow down.

• High

  A permanent open door

  If the way in was a default or weak password, wiping the device without changing the password lets the same attacker, or the next one, in again within hours.

• Medium

  Traffic seen or redirected

  A router that is controlled by someone else sits on all your traffic. Whether these programs read it is not known; VPNFilter, a different router botnet, could collect traffic according to the FBI.

• Medium

  A slow or unstable device

  High load, dropped connections and restarts are possible. They also have ordinary causes.

• Low

  Nothing at all

  If you only saw the name in a log, or the device blocked the download, no harm was done. The danger is the case you cannot yet tell apart.

Who can meet this, and who cannot

The page exists because our /check tool saw this address reported. These are the realistic readers and what each should take from it.

How a device ends up fetching files like these

The URLhaus rows do not say how any victim was reached. These are the routes that published research describes for this kind of file set.

1. 1

   A default or weak password on a remote login

   The best known botnet of this type, Mirai, found devices by looking for open Telnet ports (23 and 2323) and trying a built in list of default logins. CSO Online reported a list of 61 username and password pairs, and later reports say botnets still try that list and many more.

2. 2

   A flaw in the web page of the device

   The SANS diary describes a campaign that used a command injection flaw (CVE-2023-1389) in a router web interface to run a command that fetched a shell script, followed by programs for several chip types. Devices that never receive updates stay open to such flaws for years.

3. 3

   A server with a weak SSH login or an old web app

   The x86 and x86_64 builds suggest ordinary Linux servers are also in scope. A guessed SSH password or an unpatched web application can give an attacker the shell they need to run one wget command.

4. 4

   A device exposed to the internet by mistake

   Port forwarding, a camera set up for remote viewing or a router with remote administration switched on puts the login page in front of every scanner on the internet.

Check your network before you reset anything

Write down what you see first. The device name and the time of the request decide how serious this is. The steps are written for a home or small office network and use no special tools.

1. 1

   Find which device made the request

   Open your router's admin page and look for a log or a list of connected devices. Match the time of the log line to a device name or address. If you only have a DNS or firewall log from a security product, the entry usually names the machine. If the router does not keep logs, say so in your notes; do not guess.

2. 2

   Look for devices you do not know

   In the router's list of connected devices, note every name and address. A camera, a recorder, a printer or a smart plug you forgot about is exactly what these programs aim at. Unplug each unknown device one at a time.

3. 3

   Check remote access settings

   In the router's settings look for Remote administration, Telnet, SSH, UPnP and port forwarding. Switch off what you do not use. On a camera or recorder, look for the same options in its own menu.

4. 4

   On a Linux server, look at what is running

   Run ps aux and look for programs with names like Space or odd names running from /tmp, /var/run or /dev/shm. Run crontab -l for each user and look in /etc/cron.d for jobs you did not add. Run ss -tulpn and look for unknown listeners. We did not run these against the real files, so no match does not clear the server.

5. 5

   Search for the file names

   On a Linux server run find / -name 'Space.*' -o -name '1.sh' 2>/dev/null. A match in a temporary folder is a strong sign. Do not run any program you find; copy it aside for analysis if you need it.

6. 6

   Check the firmware version

   On the router or device admin page find the firmware version and compare it with the newest version on the maker's support page. A device that has received no update for years is exposed whatever else you do.

Clean a router, camera or small Linux device

Do the steps in order. We did not run any of these against the real files; they follow the FBI's advice for router botnets, the maker's usual reset procedure and the research cited at the end. Menu names differ by brand, so use your device's manual for the exact buttons.

1. 1

   Take the device off the network

   Unplug the internet cable and switch Wi-Fi off, or pull the power if it has no such control. This stops it taking orders and attacking others while you work.

2. 2

   Reboot does not clean it

   The FBI advised owners of routers hit by VPNFilter to reboot, but called it a temporary measure to disrupt the malware and said firmware must also be updated. For programs started by a script from /tmp a reboot may remove them, but a reboot does not close the hole they came through.

3. 3

   Factory reset the device

   Use the reset button or the reset option in the admin page. Reset returns the device to its default password, which is why the next two steps matter. If you cannot reset it, replace it.

4. 4

   Update the firmware before connecting to the internet

   Download the newest firmware from the maker's own support page on another device and load it through the admin page over a cable. If the maker no longer issues updates, the device will stay vulnerable; plan to replace it.

5. 5

   Set a new admin password straight away

   Use a long, unique password, not the one printed on the label. Also change the Wi-Fi password and any other account on the device. CISA has urged makers to end shared default passwords because they are a main way in for attackers.

6. 6

   Switch off what you do not need

   Turn off Telnet, remote administration and UPnP. If you need remote access, use the maker's cloud service with two step sign in or a VPN you run yourself.

7. 7

   For a Linux server: rebuild from a clean image

   If you found any of the file names or unknown cron jobs, do not try to clean the machine by hand. Back up your data (not programs), reinstall from a clean image, patch, and restore the data. Change SSH keys and passwords from another device.

8. 8

   Watch for a week

   Look at the router log every day for repeated requests to unknown addresses and for new devices. A quiet day does not clear the network.

If you run a website or server that may have been used

We do not know whether melonandworld.top is a site built for the purpose or a site that was hacked. URLhaus itself says its list does not tell the two apart. If you own a server that hosted these files, this is your list.