Domain > www.balem.com

More information on this domain is in AlienVault OTX

Files that talk to www.balem.com

MD5	A/V
8fd817e56a2d57f52acd4f441b42f5fe	[HW32.CDB.784a] [PWSZbot-FXE!8FD817E56A2D] [Trojan.Zbot] [Trojan/Injector.bdfw] [Trojan.Win32.Inject.cxiprh] [ZBot.SPM] [Win32/Bladabindi.CeAZdZC] [TROJ_ROVNIX.SMW] [Win.Trojan.Zbot-33681] [Trojan-Spy.Win32.Zbot.shxd] [TrojanSpy.Zbot!X4hPLinMlQM] [Troj/Fondu-AS] [TrojWare.Win32.Injector.BDES] [Trojan.PWS.Panda.5676] [Trojan.Zbot.Win32.154500] [TR/Mantsu.vxca] [TrojanSpy.Zbot.hemt] [Trojan[Backdoor]/Win32.DarkKomet] [Win32.Troj.Inject.mx.(kcloud)] [TrojanSpy.Zbot] [Virus.Win32.CeeInject] [W32/Elenoocka.A!tr] [SHeur4.BUYL]
0513f0e8e60ce65149fabab166eb6cfe	[W32.Vetor.PE] [Virus.Win32.Virut.1!O] [W32.Virut.G] [Trojan.Zbot] [Virus.Win32.Virut.hpeg] [W32.Virut.CF] [Malware] [Win32/Virut.17408] [PE_VIRUX.S-3] [Win32:Vitro] [Virus.Win32.Virut.ce] [PE:Win32.Virut.cx!1553679] [TrojWare.Win32.Injector.BDES] [Win32.Virut.56] [PE_VIRUX.S-3] [W32/Scribble-B] [Win32/Virut.bt] [Virus/Win32.Virut.ce] [Win32.Virut.ec.368640] [Virus:Win32/Virut.BN] [Win32.Virut.AM] [Win32/Virut.F] [Virus.Virut.13] [Virus.Win32.Virut.ce] [Win32.Virut.B] [Win32/Virut.NBP] [Virus.Win32.CeeInject] [W32/Krypt.DE!tr] [W32/Sality.AO] [Virus.Win32.Virut.N]

Whois

Property	Value
Email	balem@balem.com
NameServer	NS1.CAFE24.COM
Created	1998-07-22 00:00:00
Changed	2012-07-18 00:00:00
Expires	2017-07-21 00:00:00
Registrar	HANGANG SYSTEMS, INC

DNS Resolutions

Date	IP Address
2014-07-13	211.196.153.97 (ClassC)
2025-08-04	222.122.39.84 (ClassC)

HTTP/1.1 200 OKServer: nginxDate: Wed, 05 Jun 2019 15:50:07 GMTContent-Type: text/htmlContent-Length: 1577Connection: keep-aliveVary: Accept-EncodingExpires: Thu, 01 Jan 1970 00:00:01 GMTCache-Control

html xmlnshttp://www.w3.org/1999/xhtml xml:langko langko>head>meta http-equivContent-Type contenttext/html; charsetutf-8 />style typetext/css>body { width:100%; height:100%; } .wrap { position:fixed; top:50%; left:50%; margin:-185px 0 0 -315px; width:630px; height:370px; } h1 {margin: 0 0 20px; font-size: 15pt;}/style>/head>body>script typetext/javascript src/cupid.js >/script>script>function toNumbers(t){var e;return t.replace(/(..)/g,function(t){e.push(parseInt(t,16))}),e}function toHex(){for(var t,t1arguments.length&&arguments0.constructorArray?arguments0:arguments,e,o0;ot.length;o++)e+(16>to?0:)+to.toString(16);return e.toLowerCase()}function getUrlParams(){var t{};return window.location.search.replace(/?&+(^&+)(^&*)/gi,function(e,o,r){tor}),t}var atoNumbers(a630d708c275f51e9d1ebf7c66d745e5),btoNumbers(a3e10a74b9b2973163de3dad6e0ed6dd),ctoNumbers(df9290aa83bc737080ebd51bb06b8e23),nownew Date,timenow.getTime();time+864e5,now.setTime(time),document.cookieCUPID+toHex(slowAES.decrypt(c,2,a,b))+; expires+now.toUTCString()+; path/,oParamsgetUrlParams(),nCkattempt0,oParams.ckattempt&&(nCkattemptparseInt(oParams.ckattempt)),nCkattempt3&&(location.hrefhttp://www.balem.com/?ckattempt1);/script>div classwrap>div aligncenter>h1>자동등록방지를 위해 보안절차를 거치고 있습니다./h1>p>Please prove that you are human./p>form action/___verify methodPOST>input typesubmit value  OK  >/form>/div>/div>/body>/html>

Port 443

HTTP/1.1 200 OKServer: nginxDate: Wed, 05 Jun 2019 15:50:08 GMTContent-Type: text/htmlContent-Length: 1578Connection: keep-aliveVary: Accept-EncodingExpires: Thu, 01 Jan 1970 00:00:01 GMTCache-Control

html xmlnshttp://www.w3.org/1999/xhtml xml:langko langko>head>meta http-equivContent-Type contenttext/html; charsetutf-8 />style typetext/css>body { width:100%; height:100%; } .wrap { position:fixed; top:50%; left:50%; margin:-185px 0 0 -315px; width:630px; height:370px; } h1 {margin: 0 0 20px; font-size: 15pt;}/style>/head>body>script typetext/javascript src/cupid.js >/script>script>function toNumbers(t){var e;return t.replace(/(..)/g,function(t){e.push(parseInt(t,16))}),e}function toHex(){for(var t,t1arguments.length&&arguments0.constructorArray?arguments0:arguments,e,o0;ot.length;o++)e+(16>to?0:)+to.toString(16);return e.toLowerCase()}function getUrlParams(){var t{};return window.location.search.replace(/?&+(^&+)(^&*)/gi,function(e,o,r){tor}),t}var atoNumbers(a630d708c275f51e9d1ebf7c66d745e5),btoNumbers(50235aa816b2b39bdefc85eab45dc113),ctoNumbers(8f135cf1b63099f88dc82203c14648e7),nownew Date,timenow.getTime();time+864e5,now.setTime(time),document.cookieCUPID+toHex(slowAES.decrypt(c,2,a,b))+; expires+now.toUTCString()+; path/,oParamsgetUrlParams(),nCkattempt0,oParams.ckattempt&&(nCkattemptparseInt(oParams.ckattempt)),nCkattempt3&&(location.hrefhttps://www.balem.com/?ckattempt1);/script>div classwrap>div aligncenter>h1>자동등록방지를 위해 보안절차를 거치고 있습니다./h1>p>Please prove that you are human./p>form action/___verify methodPOST>input typesubmit value  OK  >/form>/div>/div>/body>/html>

Subdomains

Date	Domain	IP
www.balem.com	2014-07-13	211.196.153.97

View on OTX | View on ThreatMiner

Data with thanks to AlienVault OTX, VirusTotal, Malwr and others. [Sitemap]