home

cdn.omxcontent.com

Privacy Protection Service INC d/b/a PrivacyProtect.org  (Proxy Registrant)

Domain Information

The domain cdn.omxcontent.com is registered by proxy through PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM and was originally registered in May of 2014. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter.
Registrar:
PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM

Server location:
Oregon, United States (US)

Create date:
Monday, May 26, 2014

Expires date:
Friday, May 26, 2017

Updated date:
Sunday, May 1, 2016

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc., US

Root domain:
omxcontent.com

Whois:
3 omxcontent.com records

Scanner detections:
Detections  (94% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.DownloadsManager.E, PUP.InstallManagerLimited.O, PUP.InstallManagerLimited.Q, PUP.Installer.InstallManager, PUP.installCore.InstallManager (M), PUP.InstallCore.Installer (M), PUP.installCore.DownloadsManager.Installer (M), PUP.installCore.Download.Installer (M), PUP.installCore.InstallM (M), PUP.installCore.InstallM.Installer (M), PUP.installCore.Download (M), PUP.installCore (M)
100.00%

VIPRE Antivirus
Threat.4786018, InstallCore, Threat.4150696, Trojan.Win32.Generic
14.89%

K7 AntiVirus
Trojan , Unwanted-Program
14.89%

Avira AntiVirus
ADWARE/InstallCore.Gen9, Adware/InstallCore.766216, ADWARE/InstallCore.Gen4, Adware/InstallCore.A.232
12.77%

AVG
Generic
12.77%

Dr.Web
Trojan.InstallCore.27
10.64%

ESET NOD32
Win32/InstallCore.PP potentially unwanted application, Win32/InstallCore.SC potentially unwanted application, Win32/InstallCore.UQ potentially unwanted application
8.51%

ESET NOD32
Win32/InstallCore.PP (variant), Win32/InstallCore.QH (variant), Win32/InstallCore.QV (variant)
8.51%

Sophos
Generic PUA DI, Generic PUA AN, Generic PUA JE
6.38%

Comodo Security
ApplicUnwnt
6.38%

F-Prot
W32/A-6c5f2e7b, W32/InstallCore.AC.gen, W32/InstallCore.AG.gen
6.38%

Trend Micro House Call
Suspicious_GEN.F47V0714, Suspicious_GEN.F47V1108
4.26%

Qihoo 360 Security
Win32/Virus.Adware.f22, Win32/Virus.Adware.27c
4.26%

herdProtect (fuzzy)
a variant of edccd2bc4ec3c6f0d1d36e9a26ff34aa253123c7, a variant of 8b0e17b9d1f1894a54d28dfcf8043725b2afe6aa
4.26%

Baidu Antivirus
Adware.Win32.InstallCore
4.26%

The domain cdn.omxcontent.com has been seen to resolve to the following 25 IP addresses.

54.200.224.121
ec2-54-200-224-121.us-west-2.compute.amazonaws.com
September 16, 2016

52.34.184.36
ec2-52-34-184-36.us-west-2.compute.amazonaws.com
September 13, 2016

52.33.46.229
ec2-52-33-46-229.us-west-2.compute.amazonaws.com
September 13, 2016

54.148.183.210
ec2-54-148-183-210.us-west-2.compute.amazonaws.com
September 13, 2016

54.148.57.212
ec2-54-148-57-212.us-west-2.compute.amazonaws.com
September 13, 2016

54.69.198.37
ec2-54-69-198-37.us-west-2.compute.amazonaws.com
September 13, 2016

52.41.114.34
ec2-52-41-114-34.us-west-2.compute.amazonaws.com
September 13, 2016

52.38.209.219
ec2-52-38-209-219.us-west-2.compute.amazonaws.com
September 13, 2016

52.36.112.186
ec2-52-36-112-186.us-west-2.compute.amazonaws.com
September 13, 2016

54.186.109.173
ec2-54-186-109-173.us-west-2.compute.amazonaws.com
May 6, 2016

54.149.254.214
ec2-54-149-254-214.us-west-2.compute.amazonaws.com
May 6, 2016

54.149.165.83
ec2-54-149-165-83.us-west-2.compute.amazonaws.com
April 6, 2016

54.149.32.115
ec2-54-149-32-115.us-west-2.compute.amazonaws.com
April 6, 2016

52.25.129.200
ec2-52-25-129-200.us-west-2.compute.amazonaws.com
April 6, 2016

54.200.17.143
ec2-54-200-17-143.us-west-2.compute.amazonaws.com
May 28, 2015

52.10.86.167
ec2-52-10-86-167.us-west-2.compute.amazonaws.com
May 28, 2015

54.186.129.213
ec2-54-186-129-213.us-west-2.compute.amazonaws.com
May 28, 2015

54.200.35.81
ec2-54-200-35-81.us-west-2.compute.amazonaws.com
May 4, 2015

54.213.90.109
ec2-54-213-90-109.us-west-2.compute.amazonaws.com
May 3, 2015

54.201.58.192
ec2-54-201-58-192.us-west-2.compute.amazonaws.com
November 2, 2014

54.218.60.105
ec2-54-218-60-105.us-west-2.compute.amazonaws.com
November 2, 2014

54.213.56.207
ec2-54-213-56-207.us-west-2.compute.amazonaws.com
October 20, 2014

54.200.190.106
ec2-54-200-190-106.us-west-2.compute.amazonaws.com
September 18, 2014

54.186.219.20
ec2-54-186-219-20.us-west-2.compute.amazonaws.com
August 24, 2014

54.187.25.184
ec2-54-187-25-184.us-west-2.compute.amazonaws.com
August 19, 2014

File downloads found at URLs served by cdn.omxcontent.com.

1 / 68      (Adware)
http://cdn.omxcontent.com/?ic_user_id=872  (kik.exe)

1 / 68      (Adware)
http://cdn.omxcontent.com/c?x=2BIa4xfxRafzKISalkC MU3ZMRHCpr90pNa1xLAu69M=&c=qHufJvuphBE dCK51Dcy2xMwiUYRd/9IUANoL7qoV5Mc7d 7eFxKRqXQFSswBemy79Nn1MXzdTBBcBucsMn3Ew==&downloadAs=Minecraft Setup.exe&fallback_url=https://s3.amazonaws.com/Minecraft.Download/.../Minecraft.exe  (b93699b76e1ae263903dc58fbaee5931)

1 / 68      (Adware)
http://cdn.omxcontent.com/c?x=03WTh65wqOj1W36KeOsU6jxhu XVzX8CROEDDUfgNuU=&c=LtN6iRBnMQ7x6RYtKBvd6wPdOO2JR mUo1tnJsIs5Majpds gFHoS3TobFFwe5OkIT2 ZksjnbAI RuLYtpw g==&downloadAs=uTorrent Setup.exe&fallback_url=http://download-new.utorrent.com/endpoint/utorrent/os/windows/track/.../  (8d2573d8d4aeb7d6569bea88069008a2)

1 / 68      (Adware)
http://cdn.omxcontent.com/c?x=hqMQ47UmlGuXSGYAtOt8SHlQbZCNdqjCSU6W64WGp7c=&c=JF sc0hm0WjwHTNLzzZR3zt/mYmyYJ60leGVIca0BFJpeCMQGcdl7HUs7kLkrnQ5PosAbYft9rRGmMQLKeouwg==&downloadAs=uTorrent Setup.exe&fallback_url=http://download-new.utorrent.com/endpoint/utorrent/os/windows/track/.../  (ed260b8f2e2980d839b71ad4778966f7)

The following 45 files have been seen to comunicate with cdn.omxcontent.com in live environments.

TCP » 52.38.209.219:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.33.46.229:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.33.46.229:80
browserairexec.exe (BrowserAir by Goobzo)

TCP » 52.38.209.219:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.38.209.219:80
browserairexec.exe (BrowserAir by Goobzo)

TCP » 52.34.184.36:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 54.200.224.121:80
browser.exe (Browser)

TCP » 52.34.184.36:80
browserairexec.exe (BrowserAir by Goobzo)

TCP » 54.200.224.121:80
kometa.exe (Kometa by @COMPANY_FULLNAME@)

TCP » 52.38.209.219:80
browser.exe (Browser)

TCP » 52.33.46.229:80
citrio.exe (Citrio by CatalinaGroup)

TCP » 52.34.184.36:80
browser.exe (Browser)

TCP » 54.200.224.121:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.34.184.36:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.34.184.36:80
BrowserSafer.exe (BrowserSafer by Installer Technology Co)

TCP » 54.200.224.121:80
ShopAtHome_BAC_Service.exe (by ShopAtHome.com)

TCP » 54.200.224.121:80
browser.exe (Browser)

TCP » 52.34.184.36:80
Client.exe

TCP » 52.33.46.229:80
Client.exe

TCP » 52.34.184.36:80
ShopAtHome_BAC_Service.exe (by ShopAtHome.com)

 
Latest 20 of 66 files

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.