home

c7wfjzedvf993ij.nonulm.ru

CORLEON GROUP LTD

Domain Information

The domain c7wfjzedvf993ij.nonulm.ru registered by CORLEON GROUP LTD was initially registered in May of 2014 through REGRU-REG-RIPN. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Amsterdam, Noord-Holland within Netherlands which resides on the RIPE Network Coordination Centre network.
Registrar:
REGRU-REG-RIPN

Server location:
Noord-Holland, Netherlands (NL)

Create date:
Wednesday, May 28, 2014

Expires date:
Thursday, May 28, 2015

ASN:
AS5580 HIBERNIA TripartZ B.V.,NL

Root domain:
nonulm.ru

Whois:
1 nonulm.ru record

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.CORLEONGROUP.L, PUP.CORLEONGROUP.S, PUP.InstallMonster (M)
100.00%

VIPRE Antivirus
Threat.4845009
66.67%

Dr.Web
Trojan.InstallMonster.242
66.67%

avast!
Win32:InstallMonstr-DY [PUP]
66.67%

ESET NOD32
Win32/InstallMonstr.ER.Gen potentially unwanted application
66.67%

AVG
Adware Generic5
66.67%

K7 AntiVirus
Unwanted-Program
66.67%

Agnitum Outpost
Riskware.Agent
66.67%

NANO AntiVirus
Trojan.Win32.InstallMonster.dagkpn
66.67%

Sophos
Install Monster
66.67%

Avira AntiVirus
APPL/InstallMonst.QA
66.67%

G Data
Win32.Application.Installmonstr
66.67%

Vba32 AntiVirus
BScope.P2P-Worm.Palevo
66.67%

Panda Antivirus
PUP/InstallMonstr
66.67%

The domain c7wfjzedvf993ij.nonulm.ru has been seen to resolve to the following IP address.

5.149.255.187
June 20, 2014

File downloads found at URLs served by c7wfjzedvf993ij.nonulm.ru.

1 / 68      (Adware)
http://c7wfjzedvf993ij.nonulm.ru/get_file/?sid=23&url=http://stream.get-tune.net/listen/83946885/-606158/2997385422/.../Nadezhda_CHepraga_-_Amor_ver._1991_(get-tune.net).mp3&name=Nadezhda_CHepraga_-_Amor_ver._1991_(get-tune.net).mp3&type=mp3&size=5966802  (nadezhda_chepraga_-_amor_ver._1991_(get-tune.net).exe)

14 / 68    (Adware)
http://c7wfjzedvf993ij.nonulm.ru/.../?j=c2lkPTUzNjQmdXJsPWh0dHAlM0ElMkYlMkZzZXJ2ZXJ0dW1uZXcucnUlMkZmYXN0JTJGbmV3JTJGQXV0b2Rlc2tfTWF5YV8yMDE0LnJhciZuYW1lPUF1dG9kZXNrX01heWFfMjAxNCZ0eXBlPSZzaXplPSZybmQwPTQ3ODUyMDM3MTcxODMz  (autodesk_maya_2014.exe)

14 / 68    (Adware)
http://c7wfjzedvf993ij.nonulm.ru/.../?j=c2lkPTMwMTAmdXJsPWh0dHAlM0ElMkYlMkYzLmJlenNtcy5vcmclMkZmaWxlcyUyRjQlMkZmMm1hazNyd3h4YzA2NSUyRlNweUh1bnRlci00LnJhciZuYW1lPVNweUh1bnRlci00LnJhciZ0eXBlPWFyY2hpdmUmc2l6ZT00MzAxNTg4Nw  (spyhunter-4.exe)

URL:
http://c7wfjzedvf993ij.nonulm.ru/

Web server:
nginx/1.4.2 (PHP/5.4.17)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.