Domain > imageshells.com

More information on this domain is in AlienVault OTX

Is this malicious?

Reports

http://www.trendmicro.nl/media/misc/africa-new-saf...

https://otx.alienvault.com/pulse/56c6e16467db8c125...

Files that talk to imageshells.com

MD5	A/V
a3a4bc330e7ae9adae35b91e3fcf4cd1	[Trojan.VBKrypt.nrap] [Trojan] [Trojan/VBKrypt.nrap] [Trojan.Win32.VBKrypt.bdpskl] [WS.Reputation.1] [Injector.EDGQ] [Trojan.Win32.VBKrypt.nrap] [Trojan.Injector!QoqdoRZ40p8] [TrojWare.Win32.Injector.XFR] [BackDoor.Andromeda.22] [Mal/VBInj-Y] [Worm:Win32/Gamarue.I] [Trojan.Win32.A.VBKrypt.118784.CII] [Trojan/Win32.Injector] [W32/Backdoor.WOPR-3652] [TScope.Trojan.VB] [Worm.Win32.Gamarue] [W32/VBKrypt.MBW!tr]
00d10198dcbefb7a0cfd23c2dacd78b1	[Worm.Gamarue.A3] [W32/Worm-FDU!00D10198DCBE] [Trojan.Andromeda] [Trojan] [Riskware] [Trojan/Downloader.Andromeda.cd] [WS.Reputation.1] [Andromeda.UQ] [Trojan-Downloader.Win32.Andromeda.cd] [Trojan.DL.Andromeda!ciKkiXU1mbk] [TrojWare.Win32.TrojanDownloader.Andromeda.CD] [Trojan/Win32.Andromeda] [Win32.TrojDownloader.Andromeda.cd.(kcloud)] [Worm:Win32/Gamarue] [Trojan.Win32.A.Downloader.311296.NF] [Downloader/Win32.Andromeda] [TrojanDownloader.Andromeda] [Trojan-Downloader.Win32.Andromeda] [W32/Injector.WXP!tr]
20fd99a8879ce3230cfd38baef5b0a36	[Artemis!20FD99A8879C] [Trojan/VBKrypt.nrap] [Trojan.Win32.VBKrypt.bmayyy] [HT_VBKRYPT_BK08455D.TOMC] [Trojan.Win32.VBKrypt.nrap] [TrojWare.Win32.Injector.XFR] [BackDoor.Andromeda.22] [Trojan/Win32.VBKrypt] [Worm:Win32/Gamarue.I] [Trojan/Win32.Injector] [Trojan.Diple] [Worm.Win32.Gamarue] [W32/VBKrypt.MBW!tr]
803602d299d577f727c66ded9c2e4213	[WS.Reputation.1] [Trojan-Downloader.Win32.Andromeda.qkp] [Heur.Suspicious] [BackDoor.Andromeda.22] [Win32.TrojDownloader.Andromeda.q.(kcloud)] [Worm:Win32/Gamarue.I] [Spyware/Win32.Zbot] [W32/Andromeda.QKP!tr.dldr] [SHeur4.AZQI] [Trj/Dtcontx.A]
25c87edd34e24381ee429a8290e19af6	[Trojan/W32.Jorik.163840.CH] [Trojan] [Trojan/Injector.xdq] [Trojan.Win32.Jorik.Androm.abj] [TrojWare.Win32.VBKrypt.lat] [Artemis!25C87EDD34E2] [Trojan/Win32.Jorik] [Win32.Troj.Jorik.a.(kcloud)] [Worm:Win32/Gamarue.I] [Spyware/Win32.Zbot] [Trojan.Jorik.Androm.abj] [Worm.Win32.Gamarue] [W32/VBKrypt.MBW!tr]
0420ef61e03b26e9e946861232f4ea80	[Trojan/W32.Jorik.163840.CH] [Artemis!0420EF61E03B] [Trojan] [Trojan/Injector.xdq] [Trojan.Win32.Jorik.Androm.abj] [TrojWare.Win32.VBKrypt.lat] [Trojan/Win32.Jorik] [Win32.Troj.Jorik.a.(kcloud)] [Worm:Win32/Gamarue.I] [Trojan.Jorik.Androm.abj] [Worm.Win32.Gamarue] [W32/VBKrypt.MBW!tr]
6dc422326f8108584da4574db9cfed23	[Trojan.VBKrypt.nrap] [Trojan] [Trojan/VBKrypt.nrap] [Trojan.Win32.VBKrypt.bdinmc] [WS.Reputation.1] [Injector.EDGQ] [Trojan.Win32.VBKrypt.nrap] [Trojan.Injector!0ZjoCLgWYzs] [TrojWare.Win32.Injector.XFR] [BackDoor.Andromeda.22] [Mal/VBInj-Y] [Trojan/Win32.VBKrypt] [Worm:Win32/Gamarue.I] [Trojan/Win32.Injector] [TScope.Trojan.VB] [Worm.Win32.Gamarue] [W32/VBKrypt.MBW!tr]
ba0d90848e6de91142e8aab4bda74480	[W32.FamVT.Backdoor.VB.Trojan] [Heur.Win32.Veebee.1!O] [Worm.Gamarue.A3] [Trojan.Andromeda] [Trojan/Downloader.Andromeda.cd] [Backdoor.Androm!vtEifHQtmLk] [Downloader.Dromedan] [Andromeda.UQ] [Win32/Gamarue.OGEbSaD] [TSPY_DOWNLOADER_BK08494B.TOMC] [Backdoor.Win32.Androm.escy] [Trojan.Win32.Androm.ddukca] [TrojWare.Win32.TrojanDownloader.Andromeda.CD] [Backdoor.Androm.Win32.11370] [BehavesLike.Win32.Trojan.ft] [Troj/MDrop-FRP] [TrojanDownloader.Andromeda.cev] [Trojan[Downloader]/Win32.Andromeda] [Win32.TrojDownloader.Andromeda.cd.(kcloud)] [Worm:Win32/Gamarue] [Worm.Gamarue] [Downloader/Win32.Andromeda] [W32/Worm-FDU!BA0D90848E6D] [TrojanDownloader.Andromeda] [Trojan.Injecto]
011bd1b17467b6b654815c3218e86726	[Trojan/W32.Jorik.163840.CH] [Trojan] [Trojan/Injector.xdq] [Trojan.Win32.Jorik.bjkmse] [Trojan.Win32.Jorik.Androm.abj] [TrojWare.Win32.VBKrypt.lat] [Mal/VBInj-Y] [Trojan/Win32.Jorik] [Win32.Troj.Jorik.a.(kcloud)] [Worm:Win32/Gamarue.I] [Spyware/Win32.Zbot] [Trojan.Jorik.Androm.abj] [Worm.Win32.Gamarue] [W32/VBKrypt.MBW!tr]
a53e07f7d9fff72d9b61159d5c9760f2
a1194bfff07713fc99caa5e7eb45f196
ac96752a1562ccdd25bb866c52fac052	[Worm.Gamarue.A3] [Win32/Injector.WXP] [W32/Injector.WXP!tr] [Trojan-Downloader.Win32.Andromeda] [Backdoor.Win32.Androm.escy] [Trojan.Andromeda] [W32/Worm-FDU!AC96752A1562] [Worm*Win32/Gamarue!rfn] [Troj/MDrop-FRP] [Downloader.Dromedan] [TSPY_DO.AC055933] [Virus.73683B@16206D#E5A0.mg] [TrojanDownloader.Andromeda]

DNS Resolutions

Date	IP Address
2013-04-01	217.23.4.107 (ClassC)
2013-05-09	91.231.86.19 (ClassC)
2013-05-15	91.231.86.19 (ClassC)
2014-02-14	209.222.14.3 (ClassC)
2016-10-19	208.100.26.234 (ClassC)
2017-03-29	208.100.26.251 (ClassC)
2017-10-19	69.64.147.10 (ClassC)
2025-08-11	184.105.192.2 (ClassC)

Subdomains

Date	Domain	IP
www.imageshells.com	2025-06-16	184.105.192.2

View on OTX | View on ThreatMiner

Data with thanks to AlienVault OTX, VirusTotal, Malwr and others. [Sitemap]