plochcarsportsball.top: a server that handed out Linux malware files for routers and other devices, and what to do

What plochcarsportsball.top is, and what we know about it

plochcarsportsball.top is not a program on your computer and not a site for people. It is a web address that the abuse.ch project URLhaus lists as a place where malware files were served. We found no public write-up of this one address, so what follows is what URLhaus shows, what we saw ourselves, and what abuse.ch and the FBI have published about the kind of malware these file names point to.

1. 1

   What URLhaus lists

   Fourteen file addresses, all on plain http, all added on 15 October 2026 by one reporter (NDA0E). Thirteen sit in a folder called hiddenbin and are named Space followed by a dot and a processor name: i686, m68k, x86_64, arc, mips, mpsl, arm, arm6, sh4, ppc, x86, arm5 and arm7. The fourteenth is a shell script called 1.sh in the top folder. Every entry carries the threat label malware_download. In the data we hold, all 14 are marked offline.

2. 2

   What the tags mean

   The 13 programs are tagged elf, which is the standard program format of Linux. The script is tagged sh, a shell script. All 14 carry ua-wget, meaning the request that reported them came from the download tool wget. All 14 also carry botnetdomain. We read that as URLhaus saying the domain serves a botnet; we did not read URLhaus's own definition of that tag, so treat that reading as ours.

3. 3

   What we could not confirm

   We did not download any of the files, so we cannot say what they contain, which malware family they belong to, or where they report to. None of the 14 entries carries a family tag such as Mirai or Gafgyt. The name Space is the file name chosen by whoever runs the server; we found no source that explains it.

4. 4

   What this means for you

   If you saw the name in a firewall, router or DNS log, or in a security alert, you are not infected by that alone. The risk is for a device that ran the script and fetched a program. The files are not Windows programs, so a Windows PC that merely sees the name is not the target. The devices to think about are routers, IP cameras, video recorders and other small Linux based equipment, and Linux servers.

Kind of threat

A server that hands out a shell script and 13 Linux programs for different processor types, listed by URLhaus as malware_download and botnetdomain

Where the files are

hxxp://plochcarsportsball[.]top/1.sh and hxxp://plochcarsportsball[.]top/hiddenbin/Space.<processor>, plain http on the normal web port

Domain registered

11 August 2026, registrar PDR Ltd., status client transfer prohibited (RDAP, read 15 October 2026)

URLhaus entries

14 file addresses, all added on 15 October 2026 between 18:52 and 19:07 UTC; all 14 offline in our data

Our check

One plain request from our server on 17 October 2026: the name could not be found (ENOTFOUND). That clears nothing

Platform

Linux on many chip types: routers, cameras, recorders and servers. Not Windows, not Mac, not iPhone, not Android as a phone app

What we checked on 17 October 2026, and what we could not

We did not browse to this address and we did not download any file. What we have is one plain request made by a program on our server, the URLhaus entries held in our database and the public registration record. That is much less than a test of a live site, and the result is a mix of facts and gaps.

What happened to plochcarsportsball.top, from registration to our check

The domain is about two months old, and every report was made within a quarter of an hour. The times are UTC and come from the URLhaus data we hold and from RDAP.

1. 11 August 2026

   The domain is registered

   RDAP shows plochcarsportsball.top registered on 11 August 2026 at about 18:42 UTC through the registrar PDR Ltd. The status is client transfer prohibited, which is a standard lock that stops the domain being moved to another registrar. It says nothing about who runs the server.

2. 15 October 2026, 18:52

   Thirteen programs are reported in 20 seconds

   Between 18:52:17 and 18:52:36 UTC the reporter adds Space.i686, m68k, x86_64, arc, mips, mpsl, arm, arm6, sh4, ppc, x86, arm5 and arm7, in that order. All carry the tags botnetdomain, elf and ua-wget. The speed fits a script that tries every file in a list one after another, which is our reading and not something the entries state.

3. 15 October 2026, 19:07

   The shell script 1.sh is reported

   At 19:07:10 UTC, 15 minutes after the last program, the script 1.sh is added with the tags botnetdomain, sh and ua-wget. The order suggests the reporter found the programs first and the script that fetches them afterwards.

   

4. 15 October 2026

   All 14 entries are offline

   In the data we hold, read on 15 October 2026, every entry has the status offline. The reports therefore describe files that were reachable at some moment on that day and were not reachable when we read them.

5. 17 October 2026

   Our request finds no address

   A plain request from our server fails with ENOTFOUND, so the name does not resolve for us.

What the pattern suggests, and what it does not: a new domain, a full set of programs for 13 processor types and a script, all gone within days, looks like a short run of a malware server rather than a long running one. That is our reading of the dates, not something any report says.

How a list of files like this is normally used

A folder with the same program built for many processor types is the sign of a dropper. The script does not know what kind of device it landed on, so it tries to fetch them all or picks the one that matches. The picture below shows the order. The first step, how the script got onto a device, is not visible from the server side.

1. 1

   A script is started on a device

   How that happens is not in the URLhaus entries. For devices like routers and cameras, the usual reports are open remote login with a default or weak password, or a known flaw in the device's web interface. The FBI's advisory on the VPNFilter router malware (2018) says the entry route was not known at first and that the FBI suspected known flaws and default passwords that owners had not changed or patched.

2. 2

   The script uses wget

   All 14 entries carry the tag ua-wget, so the request that reported them used wget, a small download tool found on most Linux systems and on many routers. abuse.ch describes related shell droppers in MalwareBazaar as using wget, ftpget or curl, depending on what the device has installed.

3. 3

   The script picks a file for the processor

   The suffixes are processor names. In the same MalwareBazaar family of samples, abuse.ch notes names such as arm, arm5, arm7, mips, mpsl and x86_64 on one server. A script can try each in turn until one starts. Programs for the wrong processor simply fail to run, which is why one operator hosts thirteen.

4. 4

   The program runs on the device

   Public records of files with the same Space.arm7 name (see the next section) describe them as Linux programs flagged by vendors as Mirai. We cannot say that the files on this server are the same, only that the names match a known pattern.

What the 13 file names say about the devices they aim at

Each name ending is a processor family. Together they cover almost every kind of small networked device sold in the last twenty years. The meanings below are standard chip names; the device examples are our reading of where such chips are common, not a statement from any source.

A set this wide is the mark of a bot that wants to run on whatever it reaches. The abuse.ch YARAhub rule for Linux Mirai programs looks for ELF files that contain several of these architecture strings, which shows that this naming habit is widespread. It does not mean every server with such names runs Mirai.

Which malware family is this? What is known and what is not

The URLhaus entries for this address name no family. Related records point to Mirai style botnets, but that is a pattern match, not a finding about these 14 files.

Mirai is the best known botnet of this type. Its source code was published in 2016, and many groups have reused it since, so a Mirai tag today says more about the code lineage than about who runs a given server. Bots built on it typically scan the internet for devices with open remote login and weak passwords, join them to a network and use them to flood targets with traffic. We state that as background, not as a finding about this address.

What this can cost you

Seeing the name costs nothing. The risks below apply to a device that ran the script and then one of the programs. We do not know what these programs do, so the list is based on what such botnet programs generally do, and on what the FBI said about a router botnet.

• High

  Your router or camera works for someone else

  A device that joins a botnet takes orders from a controller. Typical jobs are attacking other sites with traffic and scanning for more devices. You may see none of it, but your connection and your address are used.

• High

  Control of the device itself

  Whoever controls it can usually change settings on it, such as DNS servers, and can see traffic that passes through a router. We found no report that these exact files do that.

• Medium

  A slow or unstable connection

  A bot sending traffic or scanning uses the device's processor and your upload speed. A router that is hot, slow or restarts often can be a sign. These signs also have ordinary causes.

• Medium

  Your address is blocked or blamed

  Attack traffic comes from your address. Some services may block it and your internet provider may contact you.

• Medium

  It returns after a restart

  The FBI said in 2018 that a reboot disrupts only part of the VPNFilter router malware and that a factory reset is needed to remove it. Another botnet may behave differently, but the advice to reset is sound.

• Low

  Nothing, if you only saw the name

  A name in a block list, a log or a warning is not an infection. The files were also marked offline.

What you may notice, and what you may not

Most infected routers and cameras show no sign at all. The signs below are possible hints, not proof; none is documented for these exact files.

How a device ends up asking for these files

Nobody visits this address on purpose. The request comes from a script on a device, so the question is how the script got there. We cannot say for this server; the routes below are the ones public sources give for this kind of botnet.

1. 1

   Remote login with a default or weak password

   Bots of this type scan the internet for Telnet or SSH and try lists of common passwords. A device with remote login open to the internet and a factory password is the easiest target.

2. 2

   A flaw in the web interface

   Routers, cameras and recorders often have a web admin page with known flaws that the maker never fixed. A flaw lets an attacker run a command that starts wget and the script. The FBI's VPNFilter advisory points to known flaws that owners had not patched.

3. 3

   Remote management left on

   The FBI advised owners in 2018 to consider turning off remote management on a router. If the admin page can be reached from the internet, it can be tried by anyone.

4. 4

   An old device that is no longer updated

   A router, camera or recorder that has not had a firmware update in years stays open to every flaw found since. This is the common situation for the many cheap devices that such botnets live on.

5. 5

   A Linux server with a weak login or an old web application

   The x86 and x86_64 files show that servers are in scope too. A weak SSH password or an unpatched web application lets an attacker type the same download command.

Check your network before you change anything

Start with the question that matters: did a device of yours contact plochcarsportsball.top? If you came here from a log, a router page or an alert, that log names the device. Only that device is in question, not every device on the network.

No vendor publishes a removal procedure for these files, and we did not infect a device. The steps below are general checks that fit any router or Linux box; they are our judgement, not a tested result.

1. 1

   Find the device that asked

   Open your router's log or DNS history and look for plochcarsportsball.top. Note the device name or address and the time. If the router itself asked, treat the router as the device. If you cannot see any log, treat the router as the one to reset.

2. 2

   Check whether remote access is open

   Sign in to the router's admin page from inside your home network. Look for settings named remote management, remote administration, WAN access, Telnet or SSH. Any of them enabled for the internet should be off unless you set it up on purpose.

3. 3

   Look at the list of connected devices

   Your router lists every device on the network. Write down names you do not recognise. Cameras and recorders often have odd names, so check each against what you own.

4. 4

   Check the firmware version

   Find the version on the admin page and compare it with the newest one on the maker's support page. If the model no longer gets updates, that device is a risk whatever else you do.

5. 5

   On a Linux server, look for the files

   Search for a file named 1.sh and files whose names start with Space. in temporary folders such as /tmp, and look at the list of running processes and the scheduled tasks for anything you did not add. A match is a strong sign. No match does not clear the server.

6. 6

   Do not trust a quiet result

   A router that looks normal can still be part of a botnet. If the device asked for this address, or if its login was open with a weak password, go on to the plan whatever the checks show.

If you use a Windows PC, a Mac, an iPhone or an Android phone

The files on this server are Linux programs. We found nothing that says they affect a PC, a Mac or a phone directly.