What the sources say
- 2-Spyware's snapshot. 2-Spyware says the newest report is from 7 September 2026. It also says one plain request from its server to 94.154.43.60 on port 443 was refused on 23 October, and that its RDAP registration lookup returned no record. These are the publisher's own checks and I could not reproduce them.
- Scambook. Scambook says it takes its data from URLhaus. It reports 17 reports for hosting malicious content. It gives Aug 4, 2026 as the first report and Aug 10, 2026 as the last. That does not match 2-Spyware's 7 September date, so it is probably an older snapshot.
- Listed files. Scambook's list shows many files on the host with architecture-style names. Examples are k.sh, x86_64, arm4, mips and aarch64. Names like these suggest builds for Linux and embedded devices, not Windows executables.
- The 8081 port. ismalicious.com, an aggregator, lists the URL hxxp://www[.]iloveboats[.]st:8081/titan[.]ppc, with 3 sources and 5 blocklists. That suggests the September activity used a non-standard port.
- A false-positive report. A GitHub issue on the AntiphishingRD blacklist flags iloveboats.st as a possible false positive, reported by a site visitor. The issue was submitted automatically and it needs manual review, so I treat it as inconclusive.
- A possible mix-up. The boat-rental businesses I found that use similar names, such as iloveboats.it in Sardinia, are unrelated to the .st domain.
The research notes passed to me also describe URLhaus pages that list 30 URLs, with some online. They also say the files are tagged ELF and Mirai, a botnet family that targets Linux and IoT devices. I could not open the URLhaus pages in this session, so I am not treating those figures as verified.
What the numbers mean
The 14, 17 and 30 URL counts could all be right. They may be snapshots taken at different times, or they may count different things (URLs versus files versus reports). URLhaus is also updated continuously. Treat any count or online status as true only for the moment it was checked.
Windows and PC relevance
- A listing is not an infection. A log entry for this domain shows that something on your network tried to resolve or contact it. It does not show that a file was downloaded or run.
- Which device asked. Identify which device made the request. If it was a router, camera, NAS or other Linux-based gadget, Windows cleanup steps may not apply. Check that device's firmware and vendor advisories.
- If a Windows PC made the request. Check Windows Security, then Virus & threat protection, then Protection history, for detections around that time. 2-Spyware also suggests a Microsoft Defender Offline scan, but I could not confirm that the domain's payloads are Windows files.
- Network defenses. Network defenders can block the domain and IP at the DNS or firewall level. They should also watch for outbound connections on port 8081, and remember that blocking only helps against future attempts.
Caveats
- 2-Spyware's claim that most reported malware files are for Windows is not supported by the file names above. The publisher itself calls it an assumption.
- Its refused-connection test says nothing about other ports, other times or other networks. A host can be down today and have served malware last month.
- I did not find who runs the domain, whether a legitimate site was compromised, or how many victims there were.
Bottom line
Treat iloveboats.st as a reported malware-distribution host that is probably aimed at Linux and IoT devices. If it shows up in your logs, trace the device that contacted it and check whether anything was downloaded or run. Avoid Windows-only cleanup unless a Windows machine actually fetched a file from it.