home

cp.123mplayer.com

chen wenjie

Domain Information

The domain cp.123mplayer.com registered by chen wenjie was initially registered in May of 2015 through SOLUCIONES CORPORATIVAS IP,SLU. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Belfast, Northern Ireland within United Kingdom which resides on the RIPE Network Coordination Centre network.
Registrar:
GODADDY.COM, LLC

Server location:
Northern Ireland, United Kingdom (GB)

Create date:
Friday, May 29, 2015

Expires date:
Monday, May 29, 2017

Updated date:
Friday, March 18, 2016

Root domain:
123mplayer.com

Whois:
2 123mplayer.com records

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Installer.TuguuSL.R, PUP.TUGUUSL.X, PUP.Awimba.W, PUP.Tuguu.Awimba.Bundler (M), PUP.Tuguu.Bundler (M)
100.00%

Malwarebytes
Adware.DomaIQ, PUP.FakeFlash.Domaiq
75.00%

Dr.Web
Adware.W3i.28, Adware.W3i.29
75.00%

VIPRE Antivirus
DomaIQ
75.00%

Sophos
DomainIQ pay-per install, Generic PUA CF
75.00%

ESET NOD32
Win32/DomaIQ
75.00%

McAfee
Artemis!28EEABA0918A, Artemis!9B9A81AD67D1, Artemis!D466BF526FEA, Artemis!A1F31F1D4EA0, Artemis!0655343DE61B
62.50%

avast!
NSIS:DomaIQ-C [PUP], Win32:DomaIQ-AI [PUP]
62.50%

K7 AntiVirus
Trojan
50.00%

Norman
Obfuscated.gen!r, Suspicious_Gen4.ERZRG
50.00%

Comodo Security
ApplicUnwnt, UnclassifiedMalware, Application.Win32.DomaIQ.~A
50.00%

Avira AntiVirus
APPL/DomaIQ.Gen7
50.00%

IKARUS anti.virus
AdWare.DomaIQ, APPL
50.00%

Trend Micro House Call
TROJ_GEN.F47V0612, TROJ_GE.36D48563, TROJ_GE.8A30F985
37.50%

Agnitum Outpost
PUA.DomaIQ
37.50%

The domain cp.123mplayer.com has been seen to resolve to the following 5 IP addresses.

103.224.182.243
lb-182-243.above.com
April 7, 2016

92.242.140.21
unallocated.barefruit.co.uk
May 4, 2015

46.105.231.242
September 4, 2014

54.218.87.136
ec2-54-218-87-136.us-west-2.compute.amazonaws.com
September 2, 2014

54.187.111.79
ec2-54-187-111-79.us-west-2.compute.amazonaws.com
September 2, 2014

File downloads found at URLs served by cp.123mplayer.com.

1 / 68      (Adware)
http://cp.123mplayer.com/pasarela/affp/.../ClickID=13051856681374004056&PubID=113693&__tc=1374004056.96  (setup.exe)

1 / 68      (Adware)
http://cp.123mplayer.com/pasarela/affp/.../ClickID=11958342541373386095&PubID=149239&__tc=1373386096.08  (setup_v.178302271c.exe)

20 / 68    (Adware)
http://cp.123mplayer.com/pasarela/doma/dls.123mplayer.com/p/151/Setup/329/.../1029.42.117.0a4b7de1  (setup_v.173550470c.exe)

20 / 68    (Adware)
http://cp.123mplayer.com/pasarela/doma/dls.123mplayer.com/p/151/Setup/329/.../1029.42.117.0a4b7dd4  (setup_v.173550470c.exe)

24 / 68    (Adware)
http://cp.123mplayer.com/pasarela/doma/dls.nicdls.com/p/151/FlashPlayer/329/.../1029.42.117.09273dc6  (flashplayer_v.157040271c.exe)

17 / 68    (Adware)
http://cp.123mplayer.com/pasarela/doma/dls.nicdls.com/p/151/FlashPlayer/329/.../1028.42.117.0764b40d  (flashplayer_v.117255359c.exe)

8 / 68      (Adware)
http://cp.123mplayer.com/pasarela/doma/dls.123mplayer.com/p/151/Setup/329/.../1029.42.117.0a2e90b7  (setup_v.172036793c.exe)

8 / 68      (Adware)
http://cp.123mplayer.com/pasarela/doma/dls.123mplayer.com/p/151/Setup/329/.../1029.42.117.0a2e90a3  (setup_v.172036793c.exe)

22 / 68    (Adware)
http://cp.123mplayer.com/pasarela/doma/dls.nicdls.com/p/151/FlashPlayer/329/.../1029.42.117.040faf5f  (flashplayer_v.66182779c.exe)

22 / 68    (Adware)
http://cp.123mplayer.com/pasarela/doma/dls.nicdls.com/p/151/FlashPlayer/329/.../1029.42.117.040fac96  (flashplayer_v.66182779c.exe)

7 / 68      (Adware)
http://cp.123mplayer.com/pasarela/doma/dls.123mplayer.com/p/151/Setup/329/.../1029.42.117.0a4541b7  (setup_v.172358544a.exe)

7 / 68      (Adware)
http://cp.123mplayer.com/pasarela/doma/dls.123mplayer.com/p/151/Setup/329/.../1029.42.117.0a454181  (setup_v.172358544a.exe)

8 / 68      (Adware)
http://cp.123mplayer.com/pasarela/doma/dls.123mplayer.com/p/151/Setup/329/.../1029.42.117.0a35a402  (setup_v.172036793c.exe)

8 / 68      (Adware)
http://cp.123mplayer.com/pasarela/doma/dls.123mplayer.com/p/151/Setup/329/.../1029.42.117.0a35a364  (setup_v.172036793c.exe)

8 / 68      (Adware)
http://cp.123mplayer.com/pasarela/doma/dls.123mplayer.com/p/151/Setup/329/.../1029.42.117.0a35a2cc  (setup_v.172036793c.exe)

8 / 68      (Adware)
http://cp.123mplayer.com/pasarela/doma/dls.123mplayer.com/p/151/Setup/329/.../1029.42.117.0a2ebca6  (setup_v.172036793c.exe)

8 / 68      (Adware)
http://cp.123mplayer.com/pasarela/doma/dls.123mplayer.com/p/151/Setup/329/.../1029.42.117.0a2ebc53  (setup_v.172036793c.exe)

8 / 68      (Adware)
http://cp.123mplayer.com/pasarela/doma/dls.123mplayer.com/p/151/Setup/329/.../1029.42.117.0a2ebc39  (setup_v.172036793c.exe)

The following 238 files have been seen to comunicate with cp.123mplayer.com in live environments.

TCP » 92.242.140.21:80
smelled.exe (Smelled)

TCP » 92.242.140.21:443
dca-monitoring.exe (Compete DCA Monitoring Tool by Compete)

TCP » 92.242.140.21:80
marini.exe (Marini)

TCP » 103.224.182.243:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 92.242.140.21:443
client.exe (ClientWrapper)

TCP » 92.242.140.21:80
thebrowser.exe (TheBrowser by Goobzo)

TCP » 103.224.182.243:587
www.exe

TCP » 92.242.140.21:443
dca-monitoring.exe (Compete DCA Monitoring Tool by Compete)

TCP » 103.224.182.243:80
download.exe (Gerenciador de Download by ASSISTENTE DE DOWNLOAD)

TCP » 103.224.182.243:80
online-guardian-v2.0.9.exe

TCP » 103.224.182.243:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 92.242.140.21:443
WindowService.exe (WindowService)

TCP » 92.242.140.21:443
ciuninstall.exe

TCP » 92.242.140.21:1866
jutched.exe

TCP » 92.242.140.21:443
dca-monitoring.exe (Compete DCA Monitoring Tool by Compete)

TCP » 92.242.140.21:80
masterupdater.exe

TCP » 103.224.182.243:80
bi.exe (UpgradeService141217)

TCP » 103.224.182.243:80
main.exe

TCP » 103.224.182.243:80
flamengo x vasco ao vivo.exe

TCP » 92.242.140.21:80
pricemeterexpress.crx

 
Latest 20 of 238 files

URL:
http://cp.123mplayer.com/

Title:
“123mplayer.com -&nbsp123mplayer Resources and Information.”

Description:
“123mplayer.com is your first and best source for information about 123mplayer. Here you will also find topics relating to issues of general interest. We hope you find what you are looking for!”

Web server:
Apache/2.2.22 (Debian)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.