swatting.wiki: a Mirai botnet download address for routers and cameras, and what to do if a device of yours may be infected

What swatting.wiki is, and what we know about it

swatting.wiki is a web address, not a program. The malware tracker URLhaus lists it as a host that served Mirai files. Mirai goes after devices that run a small Linux system, such as home routers, cameras and video recorders, not ordinary Windows or Mac computers. We found no public write-up of this address or of the file name it uses, so this page rests on the URLhaus entries, the registration record, our own lookup and what CISA and researchers have published about Mirai in general.

1. 1

   What URLhaus lists

   14 file addresses on swatting.wiki, all with the threat type malware_download, all added on 27 September 2026 by one reporter account named BlinkzSec. The first batch arrived at 06:54 UTC and the last file, manji.arm7, at 07:09 UTC. All 14 were offline when we read them.

2. 2

   What the tags say

   Every entry carries the tags mirai, elf, botnetdomain, swatting-wiki and ua-wget. The elf tag means a Linux executable. The tag ua-wget tells you the reporter's tool saw the download requested with the wget program, a common way for a script on a small Linux device to fetch a file. The botnetdomain tag is the reporter's label for a domain used by a botnet.

3. 3

   What we could not confirm

   We did not download any file and found no analysis of these exact files. So we do not know which Mirai variant they are, which logins they try or where they report to. The tags are the reporter's labels, not our finding.

4. 4

   What this means for you

   If you only saw the name in a log or a block list, nothing is wrong with your device because of that. If a device of yours connected to this address or ran a file from it, treat the device as infected and follow the plan below.

Kind of threat

A malware download host: 14 files, all tagged mirai

Malware family

Mirai, an IoT botnet (the reporter's tag; not confirmed by us)

Registration

Registered 6 September 2026 through Porkbun, expires 6 September 2027, record last changed 28 September 2026

URLhaus entries

14 file addresses, all added on 27 September 2026; all 14 offline when we read them

Platform

Routers, cameras and other Linux-based network devices. Not an ordinary PC threat

What we checked on 10 October 2026, and what we could not

We tried to open https://swatting.wiki/ once, from Lithuania, in an automated Chromium browser set to English. The browser reported that the name could not be found, so no page loaded. That tells you nothing good about the host and it clears nothing.

What happened to swatting.wiki, from registration to our test

The visible history is a registration, one burst of 15 minutes on one morning and then silence. We have no earlier or later reports for this host.

1. 6 September 2026

   The name is registered

   The registry record gives the creation date as 6 September 2026 and the registrar as Porkbun. We have no page, archive copy or report from the following three weeks.

2. 27 September 2026, 06:54 UTC

   Thirteen files are reported at once

   URLhaus receives manji.arm4 and manji.sh4 at 06:54:15 and eleven more within eight seconds: x86, i486, i686, arm5, arm6, mips, mpsl, ppc, ppc440, m68k and spc. All carry the tag mirai.

   

3. 27 September 2026, 07:09 UTC

   One more file

   The last entry, manji.arm7, is added at 07:09:40, fifteen minutes after the first. After this URLhaus records nothing new for the host.

4. 28 September 2026

   The registration record changes

   The registry shows its last change on 28 September 2026, the day after the reports. We do not know what changed, so we do not read anything into it.

5. 10 October 2026

   Our test finds no address

   Our browser visit to https://swatting.wiki/ ends in ERR_NAME_NOT_RESOLVED, and URLhaus shows all 14 files offline, thirteen days after the reports.

We could not read the URLhaus pages themselves, because they ask for a browser check. The entries above come from the same data in our own database, which holds the URLhaus feed.

The file names: what they suggest, and what we do not know

File names are weak evidence. We list what each group could be and mark which statements are only our reading.

The number of builds is the most telling fact. One file per processor type means the operator did not know which kind of device a victim would be, so the same address was prepared for many kinds of device. That fits what CISA says about Mirai's targets, but it does not prove how these files were used. We found no source that explains the prefix manji, and we do not know whether it names a person, a tool or a variant.

How Mirai gets onto a device, according to CISA and researchers

We did not run or open the swatting.wiki files. This is the method CISA and academic researchers describe for Mirai in general, so you know what to look for.

1. 1

   Step one: the knock

   According to CISA, the malware never stops probing the internet for IoT devices it can break into. Nobody has to open an e-mail or click a link. Having a public address is enough to be tried.

2. 2

   Step two: the guessing

   The probing bot has a built-in list of 62 usernames and passwords that manufacturers use as defaults. CISA stresses that such defaults for most devices can be looked up online, and that this short list was nonetheless enough to reach hundreds of thousands of devices.

3. 3

   Step three: the right file

   After a login succeeds, the bot needs a program that runs on the victim's chip. That is why a host such as swatting.wiki keeps a separate file for each processor family, and why the same address can serve a camera and a router.

4. 4

   Step four: the army

   The researchers who traced the botnet for seven months counted a peak of about 600,000 infected devices, mostly embedded and IoT ones. They conclude that fairly simple methods were enough to take over many low-end devices.

CISA names home routers, network cameras and digital video recorders as the main victims in the incidents it described. It also records a late 2016 offshoot that went for port 7547 on broadband routers with a known flaw. The owner of a taken-over device usually sees no change, which is the reason this kind of host matters to people who never visited it.

What you may notice, and what you may not

Most owners notice nothing. The signs below follow from what Mirai does; none of them proves infection alone.

What this can cost you

Seeing this address in a log costs nothing. The risks below apply to a device that actually connected to it or ran one of its files.

• High

  You become the attacker's tool

  A taken-over router or camera can be ordered to flood someone else's server. The victim is a stranger, but the traffic comes from your address and your bandwidth.

• High

  A foothold inside the house

  Every device in your home talks to the internet through the router. Whoever controls it is in a position to watch or redirect that traffic. No source we read describes this for swatting.wiki, so it is a possible risk, not something observed.

• Medium

  A second infection soon after the first is cleaned

  CISA warns that plugging a device back in before changing its password can lead to quick reinfection, because the scanning never stops.

• Medium

  Friction with your internet provider

  An internet provider may warn or restrict a line that sends attack traffic. That is common practice in general, and we saw no case of it for this host.

• Low

  No harm, if all you have is the name

  Finding the name in a firewall log or on a block list does not mean any device was infected.

How a device ends up contacting an address like this

We do not know how any device reached swatting.wiki, and no source says. These are the routes CISA and the research describe for Mirai.

1. 1

   The device was found by a scanner

   A bot scanned the internet, found a device with an open login and tried the default passwords. No one clicked anything. This is the main route CISA describes.

2. 2

   A flaw in the device software

   CISA notes a variant that scanned port 7547 on broadband routers with a known flaw. An old router that no longer gets updates stays open to flaws like this.

3. 3

   A command run by someone who got in

   Once inside, the attacker has the device fetch a file that matches its processor. The ua-wget tag suggests the files were requested with wget, but we did not see the commands or scripts that made the request.

4. 4

   A log line you found

   If you only found swatting.wiki in a router or DNS log, the entry means a device on your network asked for the name. Find out which device did, because that one is the suspect.

Check your router and other devices before you reset anything

Start with the question that matters: did a device of yours connect to swatting.wiki, or does one still use its factory login with remote access on? If yes, follow the plan on this page. If you are unsure, do these checks first. None of them changes anything.

Phones and ordinary computers are not the target of these files, so this page does not give steps for them.

1. 1

   Trace the lookup to a device

   Sign in to the router (address and login are on its label or in the manual) and open its event log or the list of connected clients. Search for the word swatting. A router without logs may leave you with a DNS filtering service, if you use one, which can show which client asked.

2. 2

   Try the label login yourself

   If the admin page accepts the username and password printed on the router, or the published default for your model, assume a scanner could get in the same way.

3. 3

   Find the remote management switch

   It sits in the router's administration or security settings under a name like remote management or remote access. The FTC says to turn it off, together with WPS and UPnP.

4. 4

   Compare firmware versions

   The status or system page shows the installed version. Compare it with the newest one on the maker's website. A big gap, or a model that has no newer file at all, means you should plan a replacement.

5. 5

   Match a provider letter to a device

   A warning from your internet provider normally gives a date and an address. Compare them with the client list of your router.

6. 6

   Do not trust a calm result

   None of this looks inside the device. The malware lives in memory, so a gadget that seems fine may still be infected until you restart it while it is offline.

Clean a router, camera or recorder: the order CISA gives

CISA's removal advice is short because Mirai lives in the device's memory. We follow it here and add the settings the FTC and CISA recommend afterwards. We did not test these steps on an infected device.

1. 1

   1. Cut the connection

   Pull the network cable out and switch off the device's Wi-Fi. If this is your only router, use your phone on mobile data for the rest of the steps and accept that the home network is down meanwhile.

2. 2

   2. Power cycle it offline

   Switch it off, wait, and switch it on again with nothing connected. CISA states that Mirai resides in dynamic memory, so a reboot clears it. Do not stop here, because a reboot does not close the door the malware used.

3. 3

   3. Set a new password first

   Open the admin page over the local network and replace the default with a long password that you use nowhere else. CISA's warning is explicit: reconnecting before the reboot and the password change could lead to quick reinfection.

4. 4

   4. Install the latest firmware

   Get the file from the maker's own website. The FTC adds three habits: look for new firmware before setup and when you change settings, register the router for update notices, and ask your provider whether it pushes updates automatically.

5. 5

   5. Close the doors a bot knocks on

   Switch off remote management, WPS and UPnP. CISA advises disabling UPnP on routers unless it is absolutely necessary, and turning off unencrypted remote administration such as Telnet and FTP on network devices.

6. 6

   6. Factory reset when in doubt

   The pages we read give no reset procedure, so follow the manual for your model, usually a small button held down for several seconds. Afterwards set the password, then update the firmware, and only then reconnect.

7. 7

   7. Retire what is no longer supported

   When the maker has stopped publishing fixes, a strong password cannot repair the flaws left in the firmware. CISA recommends buying from companies known for secure products.

If you use a Windows PC, a Mac or a phone

These files are built for the small processors in network devices. We found nothing that says they run on an ordinary computer or a phone.