Domain > open.demonii.com

More information on this domain is in AlienVault OTX

Property	Value
Email	a7091b504570587c984e727eb7589641-1582836@contact.gandi.net
NameServer	NORMAN.NS.CLOUDFLARE.COM
Created	2013-04-02 00:00:00
Changed	2014-11-20 00:00:00
Expires	2016-04-02 00:00:00
Registrar	GANDI SAS

DNS Resolutions

Date	IP Address
2015-04-22	93.190.140.138 (ClassC)
2015-08-09	185.90.63.2 (ClassC)
2024-04-27	23.134.90.6 (ClassC)
2025-05-23	23.134.90.9 (ClassC)
2025-07-05	23.168.232.9 (ClassC)
2025-08-03	23.134.89.9 (ClassC)
2025-08-06	23.134.88.9 (ClassC)

HTTP/1.1 200 OKServer: nginx/1.18.0Date: Tue, 23 Apr 2024 17:35:27 GMTContent-Type: text/htmlContent-Length: 3637Last-Modified: Sat, 24 Dec 2022 08:54:38 GMTConnection: keep-aliveETag: 63a6be4e-e35Acc

!DOCTYPE HTML PUBLIC -//W3C//DTD HTML 4.01 Transitional//EN http://www.w3.org/TR/html4/loose.dtd>HTML>HEAD>    TITLE>MRTG Index Page/TITLE>    !-- Command line is easier to read using View Page Properties of your browser -->    !-- But not all browsers show that information. :-(                             -->    meta http-equivcontent-type contenttext/html; charsetiso-8859-15 >    META NAMECommand-Line CONTENT/usr/bin/indexmaker /etc/mrtg/opentracker.conf >    META HTTP-EQUIVRefresh CONTENT300 >    META HTTP-EQUIVCache-Control contentno-cache >    META HTTP-EQUIVPragma CONTENTno-cache >    META HTTP-EQUIVExpires CONTENTSat, 24 Dec 2022 08:59:43 GMT >    LINK HREFfavicon.ico relshortcut icon >    style typetext/css>/* commandline was: /usr/bin/indexmaker /etc/mrtg/opentracker.conf *//* sorry, no style, just abusing this to place the commandline and pass validation *//style>/HEAD>BODY bgcolor#ffffff text#000000 link#000000 vlink#000000 alink#000000>H1>MRTG Index Page/H1>TABLE BORDER0 CELLPADDING0 CELLSPACING10>tr>td>DIV>B>tracker - Connections/min/B>/DIV>DIV>A HREFtracker-conn.html>IMG BORDER1 ALTtracker-conn Traffic Graph SRCtracker-conn-day.png>/A>BR>SMALL>!--#flastmod filetracker-conn.html -->/SMALL>/DIV>/td>td>DIV>B>tracker - Downloaders and Seeders/B>/DIV>DIV>A HREFtracker-peer.html>IMG BORDER1 ALTtracker-peer Traffic Graph SRCtracker-peer-day.png>/A>BR>SMALL>!--#flastmod filetracker-peer.html -->/SMALL>/DIV>/td>/tr>tr>td>DIV>B>tracker - UDP Connections/B>/DIV>DIV>A HREFtracker-udp4.html>IMG BORDER1 ALTtracker-udp4 Traffic Graph SRCtracker-udp4-day.png>/A>BR>SMALL>!--#flastmod filetracker-udp4.html -->/SMALL>/DIV>/td>td>DIV>B>tracker - TCP Connections/B>/DIV>DIV>A HREFtracker-tcp4.html>IMG BORDER1 ALTtracker-tcp4 Traffic Graph SRCtracker-tcp4-day.png>/A>BR>SMALL>!--#flastmod filetracker-tcp4.html -->/SMALL>/DIV>/td>/tr>tr>td>DIV>B>tracker - Scrape Connetions/B>/DIV>DIV>A HREFtracker-scrp.html>IMG BORDER1 ALTtracker-scrp Traffic Graph SRCtracker-scrp-day.png>/A>BR>SMALL>!--#flastmod filetracker-scrp.html -->/S

View on OTX | View on ThreatMiner

Data with thanks to AlienVault OTX, VirusTotal, Malwr and others. [Sitemap]

MD5	A/V
8ee0665d815b0a995124b282c0a99026	[HackTool.Wpakill] [not-a-virus:RiskTool.Win32.WatKill.a] [Trojan.Win32.Wpakill.dbjivt] [Tool.Wpakill.7] [Artemis] [RemoveWAT] [SPR/Tool.WPAkill.B.10] [HackTool:Win32/Wpakill.B] [Artemis!8EE0665D815B] [HackTool.Win32.Wpakill] [Riskware/WatKill] [HackTool.PBY] [Hacktool.Win32.WatKill.aQRK] [Win32/Virus.RiskTool.226]
dab4e859e8c3a8940203e200b91e537a	[AdWare/AdPeak.bi] [TrojanDownloader:Win32/Rottentu.F] [Trojan.Kazy.D89FF8]
9b87b86ec6c51024a18a615a581aefa8

Domain > open.demonii.com

Is this malicious?

Files that talk to open.demonii.com

Whois

DNS Resolutions

Port 80