Domain > 51steel.org

This indicator is referenced in AlienVault OTX pulse ""

Reports

http://blog.dynamoo.com/2016/09/malware-spam-tempo...

Files that talk to 51steel.org

MD5	A/V
fdf3829c475beff1bd0eabf37b87681b	[HW32.Packed.7043] [Artemis!FDF3829C475B] [Trojan.Ransom.DCR] [TROJ_CRYPTWALL.UK] [Trojan-Ransom.Win32.Blocker.hbzn] [Win32.Malware!Drop] [TROJ_CRYPTWALL.UK] [Artemis] [TR/Crypt.Xpack.232301] [Ransom:Win32/Crowti] [Win32.Malware!Drop] [Trojan.Win32.Ransomlock.hbzn] [Win32/Filecoder.CO] [Evilware.Outbreak] [Inject2.CEHO] [Trj/CI.A]
20cb63a0ee4d900f19d198923fcbf189	[W32.Clod726.Trojan.647f] [Trojan/W32.Blocker.372736.G] [Ransom.Crowti.OB4] [Trojan.Symmi.D46BC] [Trojan.Blocker!zSHcSfcoreo] [TROJ_CRYPWALL.CBQ157V] [Trojan.Win32.Andromeda.dxysxi] [BackDoor.Andromeda.614] [TROJ_CRYPWALL.CBQ157V] [Ransom-CWall.a] [Mal/Wonton-BB] [TrojanDropper.Dycler.ev] [TR/Dropper.A.38890] [Trojan[Ransom]/Win32.Blocker] [Ransom:Win32/Crowti.A] [Troj.Ransom.W32.Blocker.hcam!c] [Trojan/Win32.FakeDoc] [Ransom-CWall.a] [Adware.Win32.iBryte.DJAS] [Win32.Trojan.Inject.Auto] [Trojan.Win32.Crypt] [W32/Kryptik.DTSF!tr] [Inject2.CEHK]

Whois

Property	Value
Name	thomas
Email	thinkflyer@gmail.com
Address	Wei Road, Baoshan District, 88 to 97, Lane
Zip Code	200444
City	Shanghi
State	Shanghai
Country	CN
Phone	+86.13918703616
Fax	+86.13918703616
NameServer	f1g1ns2.dnspod.net
Created	2003-07-11 09:13:05
Changed	2015-07-19 00:20:24
Expires	2016-07-11 09:13:05
Registrar	Xiamen ChinaSource I

DNS Resolutions

Date	IP Address
2014-09-19	114.80.253.74 (ClassC)
2014-10-21	118.99.32.147 (ClassC)
2024-12-29	172.247.49.88 (ClassC)

Port 80

HTTP/1.1 500 Internal Server ErrorServer: nginxDate: Wed, 17 Apr 2024 15:25:57 GMTContent-Type: text/html;charsetutf-8Transfer-Encoding: chunkedConnection: keep-alive

!DOCTYPE html>html langen>head>    meta http-equivContent-Type contenttext/html; charsetUTF-8>    meta nameviewport contentwidthdevice-width, initial-scale1, shrink-to-fitno>    title>芬润影院 - 高清画质震撼音效/title>    style>        body {            overflow: hidden;        }        h1 {            margin: 0;            font-family: Montserrat, sans-serif;            font-size: 4em;            color: #333;            -webkit-text-shadow: 0 2px 1px rgba(0, 0, 0, 0.6), 0 0 2px rgba(0, 0, 0, 0.7);            -moz-text-shadow: 0 2px 1px rgba(0, 0, 0, 0.6), 0 0 2px rgba(0, 0, 0, 0.7);            text-shadow: 0 2px 1px rgba(0, 0, 0, 0.6), 0 0 2px rgba(0, 0, 0, 0.7);            word-spacing: 16px;        }        p {            font-family: Open Sans, sans-serif;            font-size: 1.4em;            font-weight: bold;            color: #222;            text-shadow: 0 0 40px #FFFFFF, 0 0 30px #FFFFFF, 0 0 20px #FFFFFF;        }        .container {            position: absolute;            top: 0;            bottom: 0;            width: 100%;            background: url();            background-size: cover;        }        .wrapper {            width: 100%;            min-height: 100%;            height: auto;            display: table;        }        .content {            display: table-cell;            vertical-align: middle;        }        .item {            width: auto;            height: auto;            margin: 0 auto;            text-align: center;            padding: 8px;        }        canvas {            position: absolute;            z-index: 0;            left: 0px;            top: 0px;            width: 100%;        }        .background {            display: flex;            z-index: 3;            height: 100vh;            flex-direction: column;            align-content: center;            justify-content: center;            font-family: Text Me One, sans-serif;        }        @media only screen and (min-width: 800px) {            h1 {                font-size: 6em;            }

View on OTX | View on ThreatMiner

Data with thanks to AlienVault OTX, VirusTotal, Malwr and others. [Sitemap]