home

aws.emotiplus.com

DEVELOPMENT MEDIA 73

Domain Information

The domain aws.emotiplus.com registered by DEVELOPMENT MEDIA 73 was initially registered in March of 2015 through GODADDY.COM, LLC. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Dulles, Virginia within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Cloudfront CDN service which utilizes a number of proxy IP Addresses (see below).
Registrar:
GODADDY.COM, LLC

Server location:
Virginia, United States (US)

Create date:
Wednesday, March 18, 2015

Expires date:
Saturday, March 18, 2017

Updated date:
Saturday, March 19, 2016

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
emotiplus.com

Whois:
2 emotiplus.com records

Scanner detections:
Detections  (56% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.EmotiPlus.Optional.Installer.Meta (L), PUP.DevMedia (M)
90.32%

Sophos
PUA 'Emotiplus'
19.35%

Vba32 AntiVirus
suspected of Trojan.Downloader.gen.h
12.90%

Qihoo 360 Security
HEUR/QVM10.1.Malware.Gen, HEUR/QVM11.1.Malware.Gen, HEUR/QVM11.1.0000.Malware.Gen
12.90%

AegisLab AV Signature
W32.Sality
6.45%

Zillya! Antivirus
Backdoor.PePatch.Win32.92595
3.23%

Clam AntiVirus
Win.Adware.Agent-59030
3.23%

The domain aws.emotiplus.com has been seen to resolve to the following 128 IP addresses.

54.192.19.169
server-54-192-19-169.iad12.r.cloudfront.net
July 25, 2016

54.192.19.108
server-54-192-19-108.iad12.r.cloudfront.net
July 25, 2016

54.192.19.91
server-54-192-19-91.iad12.r.cloudfront.net
July 25, 2016

54.192.19.47
server-54-192-19-47.iad12.r.cloudfront.net
July 25, 2016

54.192.19.30
server-54-192-19-30.iad12.r.cloudfront.net
July 25, 2016

54.192.19.16
server-54-192-19-16.iad12.r.cloudfront.net
July 25, 2016

54.192.19.218
server-54-192-19-218.iad12.r.cloudfront.net
July 25, 2016

54.192.19.195
server-54-192-19-195.iad12.r.cloudfront.net
July 25, 2016

52.84.125.229
server-52-84-125-229.iad16.r.cloudfront.net
July 2, 2016

52.84.125.159
server-52-84-125-159.iad16.r.cloudfront.net
July 2, 2016

52.84.125.155
server-52-84-125-155.iad16.r.cloudfront.net
July 2, 2016

52.84.125.147
server-52-84-125-147.iad16.r.cloudfront.net
July 2, 2016

52.84.125.133
server-52-84-125-133.iad16.r.cloudfront.net
July 2, 2016

52.84.125.45
server-52-84-125-45.iad16.r.cloudfront.net
July 2, 2016

52.84.125.40
server-52-84-125-40.iad16.r.cloudfront.net
July 2, 2016

52.84.125.31
server-52-84-125-31.iad16.r.cloudfront.net
July 2, 2016

52.85.131.16
server-52-85-131-16.iad53.r.cloudfront.net
June 27, 2016

52.85.131.193
server-52-85-131-193.iad53.r.cloudfront.net
June 27, 2016

52.85.131.160
server-52-85-131-160.iad53.r.cloudfront.net
June 27, 2016

52.85.131.143
server-52-85-131-143.iad53.r.cloudfront.net
June 27, 2016

52.85.131.140
server-52-85-131-140.iad53.r.cloudfront.net
June 27, 2016

52.85.131.131
server-52-85-131-131.iad53.r.cloudfront.net
June 27, 2016

52.85.131.114
server-52-85-131-114.iad53.r.cloudfront.net
June 27, 2016

52.85.131.208
server-52-85-131-208.iad53.r.cloudfront.net
June 7, 2016

52.85.131.147
server-52-85-131-147.iad53.r.cloudfront.net
June 7, 2016

52.85.131.106
server-52-85-131-106.iad53.r.cloudfront.net
June 7, 2016

52.85.131.41
server-52-85-131-41.iad53.r.cloudfront.net
June 7, 2016

52.84.125.24
server-52-84-125-24.iad16.r.cloudfront.net
May 25, 2016

52.84.125.20
server-52-84-125-20.iad16.r.cloudfront.net
May 25, 2016

52.84.125.239
server-52-84-125-239.iad16.r.cloudfront.net
May 25, 2016

 
Showing 30 of 128 IP Addresses

File downloads found at URLs served by aws.emotiplus.com.

1 / 68      (PUP)
http://aws.emotiplus.com/.../WebInstaller1167_en.exe  (8cacfa1377572f4ae15ea29621ce2079)

0 / 68
http://aws.emotiplus.com/.../Emotiplus_en.exe  (e98581f92894791c405c3990e24fc898)

0 / 68
http://aws.emotiplus.com/.../Emotiplus_en_skype.exe  (df8ae401c38ef65912c6268a8a49c8a8)

0 / 68
http://aws.emotiplus.com/.../Emotiplus_skype.exe  (726732bf44c332e18362c4a6a0aa11c5)

1 / 68      (PUP)
http://aws.emotiplus.com/.../Emotiplus.exe  (94140dcdfcbd500532984d18335bf208)

1 / 68      (PUP)
http://aws.emotiplus.com/.../WebInstaller11622_fr.exe  (f4e0f539fa133d9f3cea033a3330e3c1)

1 / 68
http://aws.emotiplus.com/.../EmotiplusUpdate1171_en.exe  (101be7996c6c25adead1caa42c068bc9)

0 / 68
http://aws.emotiplus.com/.../EmotiplusUpdate1171_fr.exe  (ab74b1f3f76be4f57c10fece444771b2)

0 / 68
http://aws.emotiplus.com/.../EmotiplusUpdate1169_fr.exe  (45b9619c06c1e62df3f1b08d5bf6079b)

2 / 68      (PUP)
http://aws.emotiplus.com/.../WebInstaller11623_fr.exe  (adfe61328ba289344d1f0aed77608188)

0 / 68
http://aws.emotiplus.com/.../EmotiplusUpdate1170_en.exe  (b7fb8c331c37a2ec66972b75e83ea1fa)

0 / 68
http://aws.emotiplus.com/.../EmotiplusUpdate1170_fr.exe  (eaf090d0c1c7398587988af1a9e21aef)

1 / 68
http://aws.emotiplus.com/.../EmotiplusUpdate1169_en.exe  (e28151bffcd024d05761910609389fa4)

1 / 68      (PUP)
http://aws.emotiplus.com/.../WebInstaller11622_en.exe  (4a4ed6e6c10f4092ce572f9073eac9d3)

1 / 68      (PUP)
http://aws.emotiplus.com/.../WebInstaller1163_en.exe  (682034e7c2402498fa0e7e62c2f9f574)

1 / 68      (PUP)
http://aws.emotiplus.com/.../EmotiplusUpdate1168_fr.exe  (a2f743e44d2428459cdab3800cf7d40e)

1 / 68      (PUP)
http://aws.emotiplus.com/.../EmotiplusUpdate1168_en.exe  (019a442adde7967d9413beda4a93eab0)

1 / 68      (PUP)
http://aws.emotiplus.com/.../WebInstaller11618_en.exe  (f037007fb0c247e183f6d8cf11114f6a)

1 / 68      (PUP)
http://aws.emotiplus.com/.../WebInstaller11618_fr.exe  (29f9ae389c64c63deb0ff354c4911297)

1 / 68      (PUP)
http://aws.emotiplus.com/.../WebInstaller11623_en.exe  (f32b4b7febb1ed0fe64bd8019b838d0a)

1 / 68      (PUP)
http://aws.emotiplus.com/.../WebInstaller1164_fr.exe  (e5db67cb41760eb6c654ad9a6f2dc90a)

1 / 68      (PUP)
http://aws.emotiplus.com/.../WebInstaller1165_fr.exe  (c297907c7aad8bafdc8fc8ee4ca8487e)

2 / 68      (PUP)
http://aws.emotiplus.com/.../WebInstaller1165hl_fr.exe  (a3601b25be270cb3e443b8d394ebf928)

The following 159 files have been seen to comunicate with aws.emotiplus.com in live environments.

TCP » 52.84.125.40:443
Client.exe

TCP » 52.85.142.218:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 54.192.195.231:443
online-guardian-v2.0.9.exe

TCP » 54.192.19.91:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 54.192.19.16:80
wfini.exe (Trend Service by Trend)

TCP » 54.192.195.111:443
online-guardian-v2.0.9.exe

TCP » 52.85.142.51:443
UCBrowser.exe (by UCWeb)

TCP » 52.85.142.133:80
beamrise.exe (Beamrise by The Beamrise Authors)

TCP » 54.192.19.195:443
jingling.exe

TCP » 52.84.125.229:80
Mobogenie.exe (Mobogenie by Mobogenie.com)

TCP » 52.84.125.174:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 54.192.19.218:443
new_chrome.exe (1stBrowser by The 1stBrowser Authors)

TCP » 54.192.19.91:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 54.192.195.216:443
onlineguardian-v2.exe

TCP » 52.85.142.115:80
se.exe

TCP » 54.192.19.108:443
online-guardian-v2.0.9.exe

TCP » 54.192.19.218:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.85.142.218:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 54.192.19.108:443
crossbrowse.exe (Crossbrowse)

TCP » 52.85.131.84:443
browser.exe (Browser)

 
Latest 20 of 314 files

URL:
http://aws.emotiplus.com/

Network:
Amazon Cloudfront

Web server:
AmazonS3

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.