home

cdn.forumerithostbundle.com

Communigal Communication Ltd

Domain Information

The domain cdn.forumerithostbundle.com registered by Communigal Communication Ltd was initially registered in July of 2015 through GAL COMMUNICATION (COMMUNIGAL) LTD.. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter.
Registrar:
GAL COMMUNICATION (COMMUNIGAL) LTD.

Server location:
Oregon, United States (US)

Create date:
Sunday, July 26, 2015

Expires date:
Tuesday, July 26, 2016

Updated date:
Sunday, July 26, 2015

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc., US

Root domain:
forumerithostbundle.com

Whois:
1 forumerithostbundle.com record

Scanner detections:
Detections  (53% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.InstallCore.Installer (M), PUP.InstallCore.Installer.Installer (M), PUP.InstallCore.FC.Installer (M)
100.00%

Bkav FE
W32.HfsAdware
11.11%

Malwarebytes
PUP.Optional.InstallCore.SID.C
11.11%

VIPRE Antivirus
InstallCore
11.11%

AhnLab V3 Security
Trojan/Win32.Banload
11.11%

AVG
Generic
11.11%

Panda Antivirus
PUP/Multitoolbar
11.11%

The domain cdn.forumerithostbundle.com has been seen to resolve to the following 13 IP addresses.

185.53.179.8
August 10, 2016

185.53.179.12
August 1, 2016

52.25.41.73
ec2-52-25-41-73.us-west-2.compute.amazonaws.com
May 17, 2016

52.24.26.116
ec2-52-24-26-116.us-west-2.compute.amazonaws.com
May 17, 2016

54.148.57.212
ec2-54-148-57-212.us-west-2.compute.amazonaws.com
April 15, 2016

54.69.198.37
ec2-54-69-198-37.us-west-2.compute.amazonaws.com
April 15, 2016

52.26.95.11
ec2-52-26-95-11.us-west-2.compute.amazonaws.com
April 15, 2016

52.88.159.85
ec2-52-88-159-85.us-west-2.compute.amazonaws.com
February 26, 2016

52.35.10.15
ec2-52-35-10-15.us-west-2.compute.amazonaws.com
February 26, 2016

52.34.170.106
ec2-52-34-170-106.us-west-2.compute.amazonaws.com
February 26, 2016

52.25.23.136
ec2-52-25-23-136.us-west-2.compute.amazonaws.com
February 26, 2016

54.191.37.5
ec2-54-191-37-5.us-west-2.compute.amazonaws.com
February 26, 2016

54.69.11.66
ec2-54-69-11-66.us-west-2.compute.amazonaws.com
February 26, 2016

File downloads found at URLs served by cdn.forumerithostbundle.com.

1 / 68      (Adware)
http://cdn.forumerithostbundle.com/c?x=h9NANpbzuh4T7pDHyhN7n6uzeDUh4rSeLswBGcfg048=&c=fLg8BrHkMrUuWX2CZMyHHr8fnMU2A4Q1P/Or7ZNT4LcRPLBhAZ7UOtRsWbdcu1pIIZ7JhRv 523JE0eFv3vIAd2e94w6FJqDbZbCvtcABTqaHRxxtOuN vaJWn/mXgalXXjtcJHOJOJFe8E61q6Ycg==&fallback_url=https://secure.inndl.com/.../google-chrome-windows-8.exe  (10c0d456551711382b4cb4ac863ab404)

0 / 68
http://cdn.forumerithostbundle.com/c?x=jC56x3AvrOTP7aFW0bXiIlOMBpWwixVB05/ 4zgnCac=&c=oo3OlTMBFoy0uU BKke2B0muQQPGzLirToWCbE3rkqQM2jTk ZQMEDUgvZ3TxV6pM yBsyS5VnF MW3T7M0YZLr6YvihfLOKQVkDZ4HsyI9R3vZk uj0xFi2ClE9dtIz/8g/snkhwi1m0 yWI6IuPg==&fallback_url=https://secure.inndl.com/.../pioneer-pro-djs.exe  (pioneer-pro-djs.zip)

0 / 68
http://cdn.forumerithostbundle.com/c?x=T2yMnEvWVSzXGVg8DgWogy9KDkmSjGO7Yob 05bTpHI=&c=fhcOibzqPv/X7rVKg1Ig76byqbof0Gv46B7I9fYOK65rGcLsMElPX2ZtjHUnOyw512Kdn1UHbXuMR4SsqfD0B2DhkCgdp0ymyj54ku4oIZeNhKOnZVJvGIykOoJWATmaTeVEJ0Zpd7sK1N2XtTM3Re8RJSFNXRQt/SdP7hTulok=&fallback_url=https://secure.inndl.com/.../hotspot-shield.exe  (hotspot-shield.appref-ms)

0 / 68
http://cdn.forumerithostbundle.com/c?x=uS73wUXwHGOoB6H4WKkh gPw7JuKwhl USOdiZwIO/A=&c=zmYeciBWEQGo7NrdQDLdzDEj9etWBRoTqAa q0MWcaAjADqw6RmLigHdxdxw14f1bLvS7YLqm8E1l/ap5/p6mv0e4GjOCPcHxk3m8/735gXfz/rngLQyxzifvuavJDA/A sUFz8aEdnoxtfytAoNA29Qk8P/EnyvLew5NJrRNEk=&fallback_url=https://secure.inndl.com/.../counter-strike-global-offensive.msi  (counter-strike-global-offensive.appref-ms)

1 / 68      (Adware)
http://cdn.forumerithostbundle.com/c?x=A43nQIbj/B5AvuSVvpfEkGCiu deudN6mwfgGy/XJyg=&c=O6HdupT8VTpx3RK5hBYkShVGEq7W3adkOlu/NNzNhYlKyfb/x/bA4v7t0l26btVtkbZERha3hyJYU7T/SkXny/gF3nUQX2FNLs8MLwj91AZKZx4FuL6lkHs1QhMCbiwvX6cFd2kY9fCtyYmUAlni8g==&fallback_url=http://secure.inndl.com/.../max-payne-3.msi  (max-payne-3.exe)

0 / 68
http://cdn.forumerithostbundle.com/c?x=nUHk4j/mp5H9Bz23qqoJ4hnuJf7h4wsS0e7l2ZkNKx0=&c=UjpjOD IV9ygn WOvjU09Q7dmzXAdeMYLKp5S26 4oRGcgMFizGbGhzu1VtnrlkZUy4vct6uRpBBz7mTcw/hVhZceEt24fWa/a1BcDUFlCGJDiyNj4TRRYDfOPsfKgRJ1eJ/Uj7lkgK0G6h5GwC29g==&fallback_url=https://secure.inndl.com/.../roblox.exe  (roblox.zip)

1 / 68      (Adware)
http://cdn.forumerithostbundle.com/c?x=imf1NYN6oEARxnlzdlKNIMIhs9o4x1hCDm9n9JZNR9M=&c=Z7Owm armgaNGo QkMQL4Pmrg8Yybdayx6yeQ CfVQFUccmgBe43bGDQNWs7OgSSix6SpCifs1JPt2w1w9fAze7D6PEMbcv9gRxbgFtGg9kBofFgAsR45AZurXF9gyVP3QWEs0Xeb8kfx26hdHAMEw==&fallback_url=https://secure.inndl.com/.../google-chrome-windows-8.exe  (10c0d456551711382b4cb4ac863ab404)

0 / 68
http://cdn.forumerithostbundle.com/c?x=IFSKzNKGE9Qgi5zLDkKPAlBmH1SVlYkERIIfdlE7v9g=&c=Qq7i9XaF8skFj/HvEXYghuGI1M3yPGVQX5uCVBWfZ5zImfGId52y82ZQKKL3adiaM sliKTghHB3v002mlCBHpG6yiOnar8pW5oV4XVoCXbDHnrMEi3EhHK84dTfqzileYPFhXa65xmLtj nXv1mziwzqxD1WNoFn3ieZ8XHySw=&fallback_url=https://secure.inndl.com/.../microsoft-word.exe  (microsoft-word.appref-ms)

1 / 68      (Adware)
http://cdn.forumerithostbundle.com/c?x=21P KvcGYem6Hbqn6Rz4brYnA4IS4KezsCSeQt2cbPw=&c=NCG yQJ3iaH6RV73odtYkXSLiUYvAUDtnDZ rV78hXp9qL4O6uOA MZ5txitL4TVBvaZQchwwzwojxBoObMIwhpaGw0lZWq/3k3C5T/T4UBaczIkVt917WnJ1gyiK0msYSOznqNnh7oH/kdqIpgJiQ==&fallback_url=https://secure.inndl.com/.../construction-simulator-2012.exe  (342bc20873940037a9839dec849acb7d)

0 / 68
http://cdn.forumerithostbundle.com/c?x=WR7ijwjKtgAlCk93SVsbo2XFk ovRc4CKUuOMyIa LA=&c=9e/lhlDUdBGXBUEsbQwFm/62jEy1rg9F7t6M UNEPYfGLb4IujDBlnLL4kuNKt/ZTTMda3lNu7qxKMjgGZjeWLGaXVYDqbMyF7Wnw09BzDZ2z9i/6X9Sq8YK2YwZPT3vksXtqASxLPXenypLWeJhG62DdUILTT28ljSR7xTNR Q=&fallback_url=https://secure.inndl.com/.../the-sims-3.zip?st=51AMJ1EN7Om4H0pJCkdQEg&e=1441022066&downloadAs=the-sims-3.exe  (the-sims-3.appref-ms)

1 / 68      (Adware)
http://cdn.forumerithostbundle.com/c?x=uyb k2f GqdhsdhT6IMrDDCi FfMPq00UjeqZB3Ff08=&c=ZzGCFcWxQqjKOfuf8gzUJK7kQdB9Ct9yWzXvkxfTxZgYIPpfjkdbiPyfMm43yuoUHRck86qNnTFKkW29SZlUr3/gblU6fuxcwz988VCpWFgfMCfM1Yq7Gu91SY3eTIfhmbvw9lLmXhX2A1mTglcwQw==&fallback_url=https://secure.inndl.com/.../google-chrome-windows-8.exe  (cc145b106b671113a35ef032ee8139d9)

1 / 68      (Adware)
http://cdn.forumerithostbundle.com/c?x=TPn xiT91T110A2Jren3WxMW Isg6vmv8ch20fuqPF0=&c=genQ7y7ozkg TE yg1z/DUyauKLG4h5hTD4mVyIEo7uuazwllZbGe A9CoYw2QKLZkYC2q7Jx5 o0cbusxVR8FeSVwskj4irNBHZg39YM4zdO11TqEOahM jtL ua95gmFY8wmpupO8QbJVKeJ1fvA==&fallback_url=https://secure.inndl.com/.../mozilla-firefox.exe  (51a113b9da7fddea6d43ca7649cbf516)

1 / 68      (Adware)
http://cdn.forumerithostbundle.com/c?x=6bS1jEuKU2Bn9NqvKUb/eDOjqM2CBUYQdco6KJqhTac=&c=HoKfzfZUCBSq6MbiNRW4b4OKarf6RkJ4 cTdb2goRIYnnTVd42M5UXmJhaQAWiSMyDeDyLddaGhsBEUtfBGJfHIZfSkhuX55Mcmf00upTiDSMUPIyihyEeqTLO/dSWZCZw3ZtJY68ZYX2QSS2jkPdg==&fallback_url=https://secure.inndl.com/.../imo.exe  (9a51723cad69fceb45f7eae49ee99a81)

1 / 68      (Adware)
http://cdn.forumerithostbundle.com/c?x=t3wrCVkU2BLL228WQt1lT78KSMOVQQZmFlAdo7HQsY4=&c=tPFSsUrlLslCrLP 8EaYTyFcIAASWqWIgXkU9X30no9xfbIriyfVbLqQBaiEE7tf0SVf5zEvoftfr1BYdSkE/Y8nQl gpKUZrklptcVWiYCta4vH51hvBnZX5wCRmmAJNBzrOzlonII09SnfaMVzmg==&fallback_url=https://secure.inndl.com/.../format-factory.zip?st=JDnBVZD7yH7ij2yQvQrtiw&e=1439122353&downloadAs=format-factory.exe  (e96ac699b29186bbe9a395322020ab8e)

0 / 68
http://cdn.forumerithostbundle.com/c?x=7QjzHuQEMeqHhusBnL0epXgT8FXyAOYC73Zj2H8AV0I=&c=mQ NZl 3PNuaTSouqqP8Tf3h d 4qZsNkYwe5ndctD8q/8nBqE7nuNx2fyXug2RugnHOQjNdF5UM8sarhi17y9lJuME/eGjoc2zdp9QM6IC iks9Qlg8RRcra31UmHmsSnkHCoSz57PQnUUIBhPpvWVCT0U7JFv9aX20p06xpZ0=&fallback_url=https://secure.inndl.com/.../cacaoweb.exe  (cacaoweb.appref-ms)

1 / 68      (Adware)
http://cdn.forumerithostbundle.com/c?x=Aa8oM 1DmUAg3I0TNye0BP7/MtwZxYqWSvwzlyZU6IE=&c= JgrZ5Dtta6F9yj9kGNN2CWGmdbJ0bicO4K2U9y oGYIbAYJK eNrh5qjMYASMlABGf/tZu5RZjhzybz3fyOmOKaYhFXKhphcCDhNhqhzEQixXM9lSeGR3JrhahCrXM17DywHqpm3L2YOsv1xnaWRA==&fallback_url=http://secure.inndl.com/.../outlast.msi  (outlast.exe)

7 / 68      (Adware)
http://cdn.forumerithostbundle.com/c?x=yJWiAxoDNPit Vq9iGIULWQx390aTmfxPsTJO9d k7Q=&c=QO/bz2j7abDV15I8T3 0NWA0ruIXPbfcl1jummIdJ8nenbvPcN66NuVWwq1cQaGgorsqKMurPtSREoxljZqBw FVy09IPJPgCrKRFHdkRztkVoiQlp2NdX1umbdELMUKRZJWnWMm8cwyWqBQIvZqSQ==&fallback_url=https://secure.inndl.com/.../terraria.zip?st=aD8JLnLFBQg0J5I1gidE1g&e=1439857596&downloadAs=terraria.exe  (terraria.cpl)

0 / 68
http://cdn.forumerithostbundle.com/c?x=oHP8V7WERASNIO8LFDJ62w8fNK5mxeBDFMVzmf7UH2M=&c=pgom0RQRI5lJ kOp/dbuA VKAA8x8htssO4EpL14Ju3Z0F UBMfp8BjJFWsUgW0gVLFwDRvls11YuFmXZ93gKCrwuh6dOCqwcrkSE7G //nLvkoEgzJ6ZLAgkIzgy8OQIhky9jVvZcZpdnic/bafazEq23iNLPirs96gx8kTScU=&fallback_url=https://secure.inndl.com/.../happy-wheels.zip?st=qrvmxI8LCXMPh-SZYdRmfQ&e=1440548833&downloadAs=happy-wheels.exe  (happy-wheels.appref-ms)

The following 7 files have been seen to comunicate with cdn.forumerithostbundle.com in live environments.

TCP » 52.24.26.116:443
online-guardian-v2.0.9.exe

TCP » 52.24.26.116:443
online-guardian-v2.0.9.exe

TCP » 52.24.26.116:443
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.24.26.116:443
036629fbd4864725737a8ba8fe7e8cd6.exe

TCP » 185.53.179.12:80
chrome.crx

TCP » 52.24.26.116:443
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.24.26.116:443
Proxomitron.exe (Proxomitron by Groom-A-Zebu (tm))

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.