Domain > www.pk39.com

This indicator is referenced in AlienVault OTX pulse ""

Reports

http://download01.norman.no/documents/Themanyfaces...

Files that talk to www.pk39.com

MD5	A/V
521ad45c7152b2eef2d9e7f86c9c075a	[Riskware] [Trojan] [Trojan/Redosdru.gl] [Trojan.Win32.Bjlog.incbk] [Backdoor.Trojan] [Win32/Tnega.VDD] [BKDR_ZEGOST.SMZZ] [Trojan.Spy-80656] [Trojan-PSW.Win32.Bjlog.zeq] [Trojan.Win32.A.PSW-Bjlog.200192] [TrojWare.Win32.Bjlog.ZEQ] [Heuristic.LooksLike.Win32.Suspicious.J!89] [Trojan/PSW.Bjlog.asd] [Win32.Troj.Redosdru.gl.(kcloud)] [TrojanDropper:Win32/Zegost.C] [Trojan/Win32.Bjlog] [SScope.Adware.Baidu.01015] [Win32/Redosdru.GL] [Trojan.Win32.FakeMS.yt] [Trojan-PWS.Win32.Bjlog] [W32/Rincux.AA!tr] [Bck/Gh0stRat.K]
3250cd40ec815fe7c93e981dc5ec9f7f
742d1ebded62730e2aeb88e469bf2436	[W32.HfsIemusi.3991] [Trojan/Redosdru.ke] [Win32.Trojan.Redosdru.n] [W32/Trojan.SZNR-5526] [Backdoor.Trojan] [Win32/Redosdru.KE] [TROJ_SPNR.0CHH14] [Trojan.Win32.DownLoader1.ddtkxo] [Trojan.Win32.Z.Redosdru.290592[h]] [UnclassifiedMalware] [Trojan.DownLoader1.26310] [Trojan.Redosdru.Win32.3643] [TROJ_SPNR.0CHH14] [BehavesLike.Win32.Downloader.dc] [TR/Rogue.290592] [Backdoor:Win32/Zegost.B] [Trojan/Win32.Bjlog] [Artemis!742D1EBDED62] [Trojan.Win32.Redosdru.KE] [Trojan.Redosdru!aej/yjnBfNY] [Trojan.Win32.Redosdru] [Win32/DH{giU1Aw?}] [Trj/Chgt.A]

Whois

Property	Value
Email	8814483@qq.com
NameServer	NS14.XINCACHE.COM
Created	2009-01-14 00:00:00
Changed	2014-10-31 00:00:00
Expires	2016-01-14 00:00:00
Registrar	XIN NET TECHNOLOGY C

DNS Resolutions

Date	IP Address
2013-07-17	58.221.58.153 (ClassC)
2013-08-19	58.221.58.153 (ClassC)
2014-05-27	61.147.107.90 (ClassC)
2016-03-31	118.163.255.188 (ClassC)
2016-07-09	61.216.5.105 (ClassC)
2019-12-08	47.89.39.109 (ClassC)
2020-03-04	15.164.83.206 (ClassC)
2024-10-18	47.56.70.142 (ClassC)
2025-01-26	47.243.57.214 (ClassC)
2025-02-14	208.98.43.16 (ClassC)
2025-03-15	208.98.40.205 (ClassC)
2025-04-22	208.98.43.15 (ClassC)
2025-04-26	208.98.43.11 (ClassC)

HTTP/1.1 200 OKServer: nginxDate: Tue, 04 Aug 2020 16:41:00 GMTContent-Type: text/htmlContent-Length: 1724Last-Modified: Mon, 03 Jun 2019 09:15:46 GMTConnection: keep-aliveVary: Accept-EncodingETag: 5

!DOCTYPE html>html langen>head>meta charsetUTF-8>title>/title>/head>script typetext/javascript>    window.onload  function(){        var domain  getLocation();        document.title  domain;        var windowHeight  window.innerHeight-4;        document.getElementById(iframes).style.height  windowHeight+px;        document.getElementById(iframes).srchttp://www.fute.com/sell?domain+domain;    };    window.onresize  function(){        var windowHeight  window.innerHeight-4;        document.getElementById(iframes).style.height  windowHeight+px;    }; function getLocation(){    var domain   document.domain	var hostMap   domain.split(.);	var num   hostMap.length;	var lastone  hostMapnum-2+.+hostMapnum-1;  if (in_array(lastone, com.cn,gov.cn,net.cn,org.cn,com.co,co.com))	{		var lastTh  hostMapnum-3+.+hostMapnum-2+.+hostMapnum-1;		domain  lastTh;	}	else	{		domain  lastone;	}	return domain;}function in_array(search,array){    for(var i in array){        if(arrayisearch){            return true;        }    }    return false;}/script>style>    body{margin: 0; padding: 0;}    iframe{margin: 0; padding: 0; border: none; width: 100%;}/style>body>iframe idiframes>/iframe>div styledisplay: none>    script typetext/javascript>        var cnzz_protocol  ((https:  document.location.protocol) ?  https:// :  http://);        document.write(unescape(%3Cspan   idcnzz_stat_icon_5874432%3E%3C/span%3E%3Cscript src + cnzz_protocol + s22.cnzz.com/stat.php%3Fid%3D5874432 typetext/javascript%3E%3C/script%3E));		/script>/div>/body>/html>

Subdomains

Date	Domain	IP
down.pk39.com	2013-04-01	202.105.55.66
ddos.pk39.com	2013-08-18	117.41.166.168
www.pk39.com	2013-07-17	58.221.58.153

View on OTX | View on ThreatMiner

Data with thanks to AlienVault OTX, VirusTotal, Malwr and others. [Sitemap]