libss.0x504.com
Checking live DNS resolution...
100/100
CRITICAL RISK
20
Malware URLs
1
Resolved IPs
439
Abuse Reports
20
Active URLs

Threat Intelligence Summary: libss.0x504.com

Risk Level: CRITICALThreat Score: 100/100

Assessment: libss.0x504.com is actively hosting 20 malware URLs across 1 resolved IP address. The number of active endpoints suggests ongoing, organized malware distribution. This domain should be blocked at the DNS or firewall level. Malware families associated with this domain include gafgyt, elf, botnetdomain.

Recommendation: Block immediately at DNS and firewall level


Total Malware URLs: 20 — Active: 20 — Resolved IPs: 1 — Abuse Reports: 439

First Seen: 2026-03-22T15:41:20 — Last Online: 2026-04-26T23:44:54

Data aggregated from threat intelligence feeds including URLhaus and community reports.

Domain Threat Analysis

libss.0x504.com has been associated with 20 malware URLs , of which 20 are currently active . The primary threat types are malware_download, malware.

Active threat. This domain is currently serving malicious content. Multiple malware URLs have been identified on this domain. Network administrators should consider blocking this domain or monitoring traffic to it closely.

Look Up Another Domain or IP

Check any domain or IP address against our threat intelligence database.

Access This Data via API

Integrate WAYSCloud domain threat intelligence into your security tools, SIEM, or firewall rules. Query any domain programmatically for malware URLs, resolved IPs, and threat scores.

API Documentation Integration Guide

See how we classify and verify threats →

Related Threat Intelligence

Top Threats Today Latest Attacks Active Malware Domains Understanding Botnets SSH Attack Explainer How to Block Threats What is a Phishing Domain? About Malware Distribution Check Another Domain
Timeline
First Seen
2026-03-22T15:41:20
Last Seen Online
2026-04-26T23:44:54
Data Last Updated
2026-05-04T06:28:50.407226
Status Activity Timeline (50 changes recorded)

Complete history of all status changes detected for URLs on this domain. Tracking online/offline transitions helps identify malware lifecycle patterns.

OFFLINE ONLINE
http://libss.0x504.com/xlh/cccc.sh
Status changed from offline to online
ONLINE OFFLINE
http://libss.0x504.com/xlh/cccc.sh
Status changed from online to offline
OFFLINE ONLINE
http://libss.0x504.com/cccc.sh
Status changed from offline to online
ONLINE OFFLINE
http://libss.0x504.com/cccc.sh
Status changed from online to offline
OFFLINE ONLINE
http://libss.0x504.com/linux_386
Status changed from offline to online
OFFLINE ONLINE
http://libss.0x504.com/linux_arm5
Status changed from offline to online
OFFLINE ONLINE
http://libss.0x504.com/linux_ppc64el
Status changed from offline to online
OFFLINE ONLINE
http://libss.0x504.com/linux_mipsel_hardfloat
Status changed from offline to online
OFFLINE ONLINE
http://libss.0x504.com/linux_mips_softfloat
Status changed from offline to online
ONLINE OFFLINE
http://libss.0x504.com/linux_arm5
Status changed from online to offline
ONLINE OFFLINE
http://libss.0x504.com/linux_ppc64el
Status changed from online to offline
ONLINE OFFLINE
http://libss.0x504.com/linux_mipsel_hardfloat
Status changed from online to offline
ONLINE OFFLINE
http://libss.0x504.com/linux_386
Status changed from online to offline
ONLINE OFFLINE
http://libss.0x504.com/linux_mips_softfloat
Status changed from online to offline
OFFLINE ONLINE
http://libss.0x504.com/linux_386
Status changed from offline to online
OFFLINE ONLINE
http://libss.0x504.com/cccc.sh
Status changed from offline to online
OFFLINE ONLINE
http://libss.0x504.com/linux_arm7
Status changed from offline to online
OFFLINE ONLINE
http://libss.0x504.com/linux_mips_hardfloat
Status changed from offline to online
OFFLINE ONLINE
http://libss.0x504.com/linux_mips64
Status changed from offline to online
OFFLINE ONLINE
http://libss.0x504.com/linux_mips_softfloat
Status changed from offline to online
Showing 20 most recent changes of 50 total
Associated IP Addresses (1)

All IP addresses this domain has resolved to (current and historical). These IPs may host or have hosted malware URLs.

176.65.139.88
439 abuse reports Severity: medium
Malware Classification
gafgyt
IoT botnet malware also known as BASHLITE or Lizkebab. Targets Linux-based IoT devices through default credentials and known exploits. Used for launching large-scale DDoS attacks. Competes with Mirai for control of vulnerable devices.
elf
Malware family "elf" detected in threat intelligence feeds. This threat is actively monitored. Exercise caution - infrastructure may be compromised or intentionally malicious.
botnetdomain
Generic botnet command-and-control infrastructure. Domain used to coordinate infected devices, issue commands, and exfiltrate stolen data. Part of distributed botnet network infrastructure.
sh
Malicious shell script campaign. Bash/sh scripts used for initial access, downloading additional malware, establishing persistence, or cryptocurrency mining. Common in Linux server compromises.
ua-wget
Automated malware download campaign using wget user-agent strings. Indicates command-line driven infection attempts, typically part of shell script malware loaders targeting servers and IoT devices.
Malware URLs (20)

All malicious URLs identified on this domain. Status reflects last known state from threat intelligence feeds.

https://libss.0x504.com/
Active Threat
Type: malware
http://libss.0x504.com/xlh/cccc.sh
Active Threat
IP: 176.65.139.88
Type: malware_download
First Seen: 2026-03-28
sh ua-wget
https://libss.0x504.com/
Active Threat
Type: malware
https://libss.0x504.com/
Active Threat
Type: malware
https://libss.0x504.com/
Active Threat
Type: malware
http://libss.0x504.com/linux_mips64
Active Threat
IP: 176.65.139.88
Type: malware_download
First Seen: 2026-03-22
botnetdomain elf ua-wget
http://libss.0x504.com/linux_amd64
Active Threat
IP: 176.65.139.88
Type: malware_download
First Seen: 2026-03-22
botnetdomain elf ua-wget
http://libss.0x504.com/linux_mips_hardfloat
Active Threat
IP: 176.65.139.88
Type: malware_download
First Seen: 2026-03-22
botnetdomain elf ua-wget
http://libss.0x504.com/linux_386
Active Threat
IP: 176.65.139.88
Type: malware_download
First Seen: 2026-03-22
botnetdomain elf ua-wget
http://libss.0x504.com/linux_mips_softfloat
Active Threat
IP: 176.65.139.88
Type: malware_download
First Seen: 2026-03-22
botnetdomain elf ua-wget
http://libss.0x504.com/linux_arm5
Active Threat
IP: 176.65.139.88
Type: malware_download
First Seen: 2026-03-22
botnetdomain elf gafgyt ua-wget
http://libss.0x504.com/linux_aarch64
Active Threat
IP: 176.65.139.88
Type: malware_download
First Seen: 2026-03-22
botnetdomain elf ua-wget
http://libss.0x504.com/cccc.sh
Active Threat
IP: 176.65.139.88
Type: malware_download
First Seen: 2026-03-22
botnetdomain sh ua-wget
http://libss.0x504.com/linux_arm7
Active Threat
IP: 176.65.139.88
Type: malware_download
First Seen: 2026-03-22
botnetdomain elf gafgyt ua-wget
http://libss.0x504.com/linux_mipsel_hardfloat
Active Threat
IP: 176.65.139.88
Type: malware_download
First Seen: 2026-03-22
botnetdomain elf ua-wget
http://libss.0x504.com/linux_mipsel_softfloat
Active Threat
IP: 176.65.139.88
Type: malware_download
First Seen: 2026-03-22
botnetdomain elf ua-wget
http://libss.0x504.com/linux_mips64el
Active Threat
IP: 176.65.139.88
Type: malware_download
First Seen: 2026-03-22
botnetdomain elf ua-wget
http://libss.0x504.com/linux_ppc64el
Active Threat
IP: 176.65.139.88
Type: malware_download
First Seen: 2026-03-22
botnetdomain elf ua-wget
http://libss.0x504.com/linux_arm6
Active Threat
IP: 176.65.139.88
Type: malware_download
First Seen: 2026-03-22
botnetdomain elf gafgyt ua-wget
http://libss.0x504.com/linux_ppc64
Active Threat
IP: 176.65.139.88
Type: malware_download
First Seen: 2026-03-22
botnetdomain elf ua-wget