Domain > sh.st

Welcome! Right click nodes and scroll the mouse to navigate the graph.

More information on this domain is in AlienVault OTX

Is this malicious?

Most users have voted this as not malicious

Files that talk to sh.st

MD5	A/V
f24de5e9a441e27537ad5a1ffe1f6f3f
8a1ed470542ff4e3beba1c6189604610
52ed1b318ba771674f29ba1de5a4a018
6ad07e8610368687223d8ac878d26ebf	[HW32.Packed.980A] [Artemis!6AD07E861036] [PUP.Optional.Amonetize] [Troj.Downloader.W32!c] [W32/Trojan.TWHZ-2646] [Adware.Amonetize.2422413[h]] [trojandropper.win32.kaymundler.c] [TR/AD.Kaymundler.czijp] [TrojanDropper:Win32/Kaymundler.C] [MultiDropper_c.BOAI] [Trj/CI.A] [Win32/Virus.Downloader.c27]

DNS Resolutions

Date	IP Address
2013-10-13	195.122.153.80 (ClassC)
2013-11-29	195.122.153.188 (ClassC)
2013-11-29	195.122.152.189 (ClassC)
2013-11-30	195.122.153.189 (ClassC)
2014-06-24	195.122.153.102 (ClassC)
2014-06-24	195.122.153.101 (ClassC)
2014-06-25	195.122.153.56 (ClassC)
2014-06-25	195.122.153.57 (ClassC)
2014-06-27	37.58.126.91 (ClassC)
2014-06-28	37.58.126.92 (ClassC)
2014-06-28	37.58.126.94 (ClassC)
2014-09-03	104.16.20.10 (ClassC)
2014-09-03	104.16.21.10 (ClassC)
2014-09-10	149.126.77.226 (ClassC)
2014-09-10	185.11.125.226 (ClassC)
2014-11-18	78.140.188.188 (ClassC)
2015-04-20	78.140.188.189 (ClassC)
2018-10-02	78.140.188.188 (ClassC)
2024-02-07	172.67.68.250 (ClassC)
2024-02-14	104.26.6.218 (ClassC)
2024-03-16	104.26.7.218 (ClassC)
2025-01-02	64.190.63.222 (ClassC)

HTTP/1.1 301 Moved PermanentlyDate: Sun, 27 Aug 2023 15:09:54 GMTContent-Type: text/html; charsetUTF-8Transfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.6.40-0+deb8u16Set-Cookie: PHPS

!DOCTYPE html>html>head>meta charsetUTF-8 />script typetext/javascript>(window.NREUM||(NREUM{})).init{ajax:{deny_list:bam.nr-data.net}};(window.NREUM||(NREUM{})).loader_config{licenseKey:28e0508023,applicationID:9451001};;/*! For license information please see nr-loader-rum-1.236.0.min.js.LICENSE.txt */(()>{use strict;var e,t,n{5763:(e,t,n)>{n.d(t,{P_:()>f,Mt:()>p,C5:()>s,DL:()>m,OP:()>_,lF:()>E,Yu:()>y,Dg:()>g,CX:()>c,GE:()>b,sU:()>j});var rn(8632),in(9567);const o{beacon:r.ce.beacon,errorBeacon:r.ce.errorBeacon,licenseKey:void 0,applicationID:void 0,sa:void 0,queueTime:void 0,applicationTime:void 0,ttGuid:void 0,user:void 0,account:void 0,product:void 0,extra:void 0,jsAttributes:{},userAttributes:void 0,atts:void 0,transactionName:void 0,tNamePlain:void 0},a{};function s(e){if(!e)throw new Error(All info objects require an agent identifier!);if(!ae)throw new Error(Info for .concat(e, was never set));return ae}function c(e,t){if(!e)throw new Error(All info objects require an agent identifier!);ae(0,i.D)(t,o),(0,r.Qy)(e,ae,info)}var dn(7056);const u()>{const e{blockSelector:data-nr-block,maskInputOptions:{password:!0}};return{allow_bfcache:!0,privacy:{cookies_enabled:!0},ajax:{deny_list:void 0,enabled:!0,harvestTimeSeconds:10},distributed_tracing:{enabled:void 0,exclude_newrelic_header:void 0,cors_use_newrelic_header:void 0,cors_use_tracecontext_headers:void 0,allowed_origins:void 0},session:{domain:void 0,expiresMs:d.oD,inactiveMs:d.Hb},ssl:void 0,obfuscate:void 0,jserrors:{enabled:!0,harvestTimeSeconds:10},metrics:{enabled:!0},page_action:{enabled:!0,harvestTimeSeconds:30},page_view_event:{enabled:!0},page_view_timing:{enabled:!0,harvestTimeSeconds:30,long_task:!1},session_trace:{enabled:!0,harvestTimeSeconds:10},harvest:{tooManyRequestsDelay:60},session_replay:{enabled:!1,harvestTimeSeconds:60,sampleRate:.1,errorSampleRate:.1,maskTextSelector:*,maskAllInputs:!0,get blockClass(){returnnr-block},get ignoreClass(){returnnr-ignore},get maskTextClass(){returnnr-mask},get blockSelector(){return e.blockSelector},set

Port 443

Subdomains

Date	Domain	IP
ww2.sh.st	2024-12-25	64.190.63.222
static.sh.st	2024-10-31	64.190.63.222
www.sh.st	2024-11-10	64.190.63.222

View on OTX | View on ThreatMiner

Data with thanks to AlienVault OTX, VirusTotal, Malwr and others. [Sitemap]