home

allplayer.pl.joydownload.com

Domains By Proxy, LLC  (Proxy Registrant)

Domain Information

The domain allplayer.pl.joydownload.com is registered by proxy through GODADDY.COM, LLC and was originally registered in March of 2013. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Ashburn, Virginia within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform.
Registrar:
GODADDY.COM, LLC

Server location:
Virginia, United States (US)

Create date:
Monday, March 18, 2013

Expires date:
Saturday, March 18, 2017

Updated date:
Thursday, January 28, 2016

ASN:
AS14618 AMAZON-AES - Amazon.com, Inc.,US

Root domain:
joydownload.com

Whois:
1 joydownload.com record

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.InnovativeSystems.L, PUP.InnovativeSystems.Installer, PUP.InnovativeSystems.Installer (M)
100.00%

Dr.Web
Threat.Undefined
66.67%

ESET NOD32
Win32/JoyDownloader.D potentially unwanted application
66.67%

Malwarebytes
PUP.Optional.OpenCandy
66.67%

Agnitum Outpost
Riskware.Agent
66.67%

Trend Micro House Call
Suspici.792C221A
66.67%

Clam AntiVirus
Win.Trojan.Agent-803351
66.67%

Avira AntiVirus
APPL/Downloader.Gen
66.67%

AhnLab V3 Security
PUP/Win32.OpenCandy
66.67%

McAfee
Artemis!DE5DD5E1CD72
66.67%

Baidu Antivirus
Adware.Win32.OpenCandy
66.67%

AVG
OpenCandy
66.67%

The domain allplayer.pl.joydownload.com has been seen to resolve to the following 4 IP addresses.

50.19.96.56
ec2-50-19-96-56.compute-1.amazonaws.com
April 4, 2016

54.225.168.223
ec2-54-225-168-223.compute-1.amazonaws.com
April 4, 2016

23.21.241.197
ec2-23-21-241-197.compute-1.amazonaws.com
December 30, 2014

23.23.159.111
ec2-23-23-159-111.compute-1.amazonaws.com
December 30, 2014

File downloads found at URLs served by allplayer.pl.joydownload.com.

12 / 68    (Adware)
http://allplayer.pl.joydownload.com/get_azure_file/.../dl7xmApivJYruNjMJzcrkF ggnhoW6Iz hV7zLaB2nT7gWptP5YSxRXP7sZOSniQidb0AT4Y3KztnounkFxtrnBei3J5OECbzRVSnsZG9zQ4ucw==  (allplayeren.exe)

12 / 68    (Adware)
http://allplayer.pl.joydownload.com/get_azure_file/wUiS4WnYccXAwj 1RrjxCgghkkVxZmbzR1 xcteQv U8/zOh/jwnickFbk3lYqn5O2G3g15aOHHIX/usW782yath1s3eDQqb7XqwTB 17Wm00v/.../8 TWO5uEiPxat D9G3csi8aHlO1IK3GeM2yURJuJr2zlL5a6BnxnD6Q5MMp5L5Fif35tnFiCdjbbdDT5ZpYDxj7LPuWFg9nB3z3dROAX29Wk2v8tOxhR0ucw==  (allplayeren.exe)

1 / 68      (Adware)
http://allplayer.pl.joydownload.com/get_azure_file/wUiS4WnYccXGwj 8XPavWwllklYzNSr2RESyPI2a4KFjs3ur6j1gwJgELk31MeKoLXj/ylZSIGGICeLkErY90f85kNSWRAaX9T36DkTzsHmtgLbbrdPK0jofs55piVRJF3ylACwx0NEivSH7UHGYUrcfwsXrJWhEerJxJR8FIeiuCC4gP43cLVgoiqv2R25lIcenw ZsBGi s1/Jn/.../Mz4SXvjoZSUiCdjbbdDT5ZpYDxj7LPuWFg9nB3z3dROAX29Wk2v8tOxhR0ucw==  (allplayeren.exe)

1 / 68      (Adware)
http://allplayer.pl.joydownload.com/get_azure_file/wUiS4WnYccXEwj 8WvauHEA0kxQ8PTK1HRzga5/ZtukkrTyqsGMxwdkEP0DverC/NXK8ykYMayDMR7juXfdr0bIjzs XFV3No2 kXQ i mm0yP/TpMuH0nFA4p83iUcFDSjzVXk2hshq9CnwSCfdUrcfwsbrJTYVY/o4LBIddfajRHE8csjENBkgjqXsEDQuO4/.../9sVz2ouRnFnvV Bpave4GkaXtOion9RKtxjRZM54n5jF3wbq99lSqtQMVe5NX4Gi37uMiamydjbbJJV9JkZSoxu6GtHB9rnEfsi50YQmW0RFitvc skh0ucw==  (allplayeren.exe)

12 / 68    (Adware)
http://allplayer.pl.joydownload.com/get_azure_file/wUiS4WnYccXBwj qXP7oQkEsml0kODC1E1v4Y9bB87pi/269qG542dkMLE/.../ygs9PSibgAgz2oZ3lwA0lNT8=  (allplayeren.exe)

12 / 68    (Adware)
http://allplayer.pl.joydownload.com/get_azure_file/wUiS4WnYccXBwj zXP7oQkEsml0kPTy1E1v4YdzZp7dvriWi8yE3iYccJgTtYbHubi/ggAgJezbOCeLkErM90ewohJ/fUh6apiX5CEfwvHy9jPTVpZrSk2lZ/.../9mh0RikP Mg1Xn4HZoVu9WwAHPquYPWw3gybPVJQ44vO30htOqlDxEihBW6xZ0dRz7qRQfxqYjjzx0ucw==  (allplayeren.exe)

The following file have been seen to comunicate with allplayer.pl.joydownload.com in live environments.

TCP » 23.21.241.197:80
install_flash_player-oc-jd.exe

URL:
http://allplayer.pl.joydownload.com/

Title:
“ALLPlayer - pobierz ALLPlayer 6.1 po polsku na JoyDownload”

Description:
“P { margin-bottom: 0 – pobierz ALLPlayer wersję aktualną tutaj.”

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
nginx/1.9.12 (PHP/5.3.10-1ubuntu3.21)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.