Domain > p.s4g5.com

More information on this domain is in AlienVault OTX

Files that talk to p.s4g5.com

MD5	A/V
7b6fc31eb7c5acd0c1a1a2f83483a3e9	[Suspicious.Cloud.2] [Worm.Win32.Dropper.RA] [Trojan:W32/DelfInject.R] [Win32.Adware.FlyStudio.O]

DNS Resolutions

Date	IP Address
2025-08-17	139.9.125.189 (ClassC)
2025-08-29	193.112.116.230 (ClassC)

HTTP/1.1 200 OKServer: nginxDate: Mon, 21 Oct 2024 06:00:29 GMTContent-Type: text/htmlContent-Length: 1280Connection: keep-aliveVary: Accept-EncodingLast-Modified: Fri, 22 Jul 2022 08:24:54 GMTVary: A

html>head>meta http-equivContent-Language contentzh-CN>meta HTTP-EQUIVContent-Type CONTENTtext/html; charsetutf-8>title>/title>/head>body>script languagejavascript>	//	var _domain_37  p.777wyx.com|p.17kuxun.com|p.zx910.com;	var _domain_67  p.yocc.net|p.zx915.com;	var _domain_95  p.haliyuya.com|p.0wan0.com;		//baidu_tg	var _domain_1  sgyx.17kuxun.com;	var _domain_2  sqyx.17kuxun.com;	var _domain_3  aszt.17kuxun.com;	var _domain_cu  document.domain;	if((location.search).indexOf(?404)!-1){		if((location.href).indexOf(/s/1/403/)!-1||(location.href).indexOf(/s/2/208/)!-1||(location.href).indexOf(/s/3/1030/)!-1){			url  /nopage.html;		}else{			url  /1/843.html;		}	}else if(_domain_37.indexOf(_domain_cu)!-1){		url  /1/820.html;	}else if(_domain_67.indexOf(_domain_cu)!-1){		url  /2/821.html;	}else if(_domain_95.indexOf(_domain_cu)!-1){		url  /3/822.html;	}else if(_domain_1.indexOf(_domain_cu)!-1){		url  /s/1/381/2763.html;	}else if(_domain_2.indexOf(_domain_cu)!-1){		url  /s/1/381/2747.html;	}else if(_domain_3.indexOf(_domain_cu)!-1){		url  /s/1/381/2764.html;	}else{		url  /1/823.html;	}	document.location.hrefurl;/script>/body>/html>

View on OTX | View on ThreatMiner

Data with thanks to AlienVault OTX, VirusTotal, Malwr and others. [Sitemap]

Domain > p.s4g5.com

Is this malicious?

Files that talk to p.s4g5.com

DNS Resolutions

Port 80