home

d21m4u3yvwhf8i.cloudfront.net

Amazon.com, Inc

Domain Information

The domain d21m4u3yvwhf8i.cloudfront.net registered by Amazon.com, Inc was initially registered in April of 2008 through MARKMONITOR INC.. Currently this domain has been known to host various forms of malware. The hosted servers are located in Seattle, Washington within the United States. The domain uses the Amazon Cloudfront CDN service which utilizes a number of proxy IP Addresses (see below).
Registrar:
MARKMONITOR INC.

Server location:
Washington, United States (US)

Create date:
Friday, April 25, 2008

Expires date:
Thursday, April 25, 2019

Updated date:
Thursday, May 5, 2016

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
cloudfront.net

Whois:
1 cloudfront.net record

Scanner detections:
Malware distribution  (78% detected)

Scan engine
Details
Detections

Microsoft Security Essentials
Worm:Win32/NeksMiner.A, Threat.Undefined
73.33%

ESET NOD32
MSIL/Adware.Imali.C application, Win32/Neshta.A virus, Win32/Virut.NBP virus
73.33%

avast!
Win32:Evo-gen [Susp], Win32:Apanas [Trj], Win32:Virtu-A, Win32:Vitro
73.33%

Norman
Gen:Variant.Razy.18672, Win32.Neshta.A, Win32.Virtob.Gen.12
66.67%

F-Prot
W32/HLLP.41472, W32/Virut.E.gen, W32/Sality.D.gen, W32/Virut.AI!Generic, W32/Virut.AM
66.67%

Emsisoft Anti-Malware
Gen:Variant.Razy.18672, Win32.Neshta, Win32.Virtob.Gen.12
60.00%

AVG
Worm/Delf.FF, Win32/Virut
53.33%

Dr.Web
Win32.HLLP.Neshta, Win32.Virut.56
46.67%

Kaspersky
Virus.Win32.Neshta, Virus.Win32.Virut
33.33%

F-Secure
Application:W32/Generic.70053c248f!Online, Variant.Razy.18672, Win32.Neshta.A, Win32.Virtob.Gen.12
26.67%

McAfee
Virus.W32/Virut.n.gen
26.67%

Reason Heuristics
Adware.Imali, Adware.Downloader.Meta (M), Adware.Downloader (M)
20.00%

VIPRE Antivirus
Threat.4120919
6.67%

The domain d21m4u3yvwhf8i.cloudfront.net has been seen to resolve to the following 72 IP addresses.

54.230.193.8
server-54-230-193-8.iad53.r.cloudfront.net
August 29, 2016

54.230.193.243
server-54-230-193-243.iad53.r.cloudfront.net
August 29, 2016

54.230.193.208
server-54-230-193-208.iad53.r.cloudfront.net
August 29, 2016

54.230.193.185
server-54-230-193-185.iad53.r.cloudfront.net
August 29, 2016

54.230.193.162
server-54-230-193-162.iad53.r.cloudfront.net
August 29, 2016

54.230.193.123
server-54-230-193-123.iad53.r.cloudfront.net
August 29, 2016

54.230.193.119
server-54-230-193-119.iad53.r.cloudfront.net
August 29, 2016

54.230.193.116
server-54-230-193-116.iad53.r.cloudfront.net
August 29, 2016

52.84.125.139
server-52-84-125-139.iad16.r.cloudfront.net
August 26, 2016

52.84.125.91
server-52-84-125-91.iad16.r.cloudfront.net
August 26, 2016

52.84.125.90
server-52-84-125-90.iad16.r.cloudfront.net
August 26, 2016

52.84.125.51
server-52-84-125-51.iad16.r.cloudfront.net
August 26, 2016

52.84.125.46
server-52-84-125-46.iad16.r.cloudfront.net
August 26, 2016

52.84.125.32
server-52-84-125-32.iad16.r.cloudfront.net
August 26, 2016

52.84.125.200
server-52-84-125-200.iad16.r.cloudfront.net
August 26, 2016

52.84.125.184
server-52-84-125-184.iad16.r.cloudfront.net
August 26, 2016

54.192.19.48
server-54-192-19-48.iad12.r.cloudfront.net
August 26, 2016

54.192.19.27
server-54-192-19-27.iad12.r.cloudfront.net
August 26, 2016

54.192.19.25
server-54-192-19-25.iad12.r.cloudfront.net
August 26, 2016

54.192.19.20
server-54-192-19-20.iad12.r.cloudfront.net
August 26, 2016

54.192.19.170
server-54-192-19-170.iad12.r.cloudfront.net
August 26, 2016

54.192.19.168
server-54-192-19-168.iad12.r.cloudfront.net
August 26, 2016

54.192.19.58
server-54-192-19-58.iad12.r.cloudfront.net
August 26, 2016

54.192.19.4
server-54-192-19-4.iad12.r.cloudfront.net
August 24, 2016

54.192.19.173
server-54-192-19-173.iad12.r.cloudfront.net
August 24, 2016

54.192.19.153
server-54-192-19-153.iad12.r.cloudfront.net
August 24, 2016

54.192.19.103
server-54-192-19-103.iad12.r.cloudfront.net
August 24, 2016

54.192.19.47
server-54-192-19-47.iad12.r.cloudfront.net
August 24, 2016

54.192.19.42
server-54-192-19-42.iad12.r.cloudfront.net
August 24, 2016

54.192.19.5
server-54-192-19-5.iad12.r.cloudfront.net
August 24, 2016

 
Showing 30 of 72 IP Addresses

File downloads found at URLs served by d21m4u3yvwhf8i.cloudfront.net.

6 / 68      (Malware)
http://d21m4u3yvwhf8i.cloudfront.net/SilentInstaller_dotnet2.exe  (787711518424ea948dbf5ef7de3ab1c9)

10 / 68    (Malware)
http://d21m4u3yvwhf8i.cloudfront.net/prepreinstaller_win.exe  (2ucv9niqnz.exe)

1 / 68      (PUP)
http://d21m4u3yvwhf8i.cloudfront.net/prepreinstaller_win.exe  (bfc61cfbf28ea3506137c405b550a45e)

2 / 68      (false positives)
http://d21m4u3yvwhf8i.cloudfront.net/SilentInstaller_dotnet4.exe  (wrar420.exe)

1 / 68      (PUP)
http://d21m4u3yvwhf8i.cloudfront.net/prepreinstaller_win.exe  (bffbf08e403520ffff84ed831dcf15dd)

6 / 68      (Malware)
http://d21m4u3yvwhf8i.cloudfront.net/SilentInstaller_dotnet4.exe  (02e1baeeb4b8a32266d5566592aee604)

6 / 68      (Malware)
http://d21m4u3yvwhf8i.cloudfront.net/SilentInstaller_dotnet4.exe  (709d4a2b2f471ef31db8fb02e94e2988)

10 / 68    (Malware)
http://d21m4u3yvwhf8i.cloudfront.net/SilentInstaller_dotnet4.exe  (66f29f625afc63daca859a92a025f882)

10 / 68    (Malware)
http://d21m4u3yvwhf8i.cloudfront.net/SilentInstaller_dotnet2.exe  (4de833f08b03bd8b317591fa69bc1ad0)

9 / 68      (Malware)
http://d21m4u3yvwhf8i.cloudfront.net/SilentInstaller_dotnet4.exe  (b3ec1c75237091451ed688abe49df34b)

0 / 68
http://d21m4u3yvwhf8i.cloudfront.net/SilentInstaller_dotnet4.exe  (sdfa6f8.exe)

0 / 68
http://d21m4u3yvwhf8i.cloudfront.net/SilentInstaller_dotnet4.exe  (libmod_plugin.dll)

9 / 68      (Malware)
http://d21m4u3yvwhf8i.cloudfront.net/SilentInstaller_dotnet4.exe  (ea87023e3f47f70c68847461901747df)

7 / 68      (Malware)
http://d21m4u3yvwhf8i.cloudfront.net/SilentInstaller_dotnet4.exe  (89bd6f846873208f39e2c104f8096bb8)

11 / 68    (Malware)
http://d21m4u3yvwhf8i.cloudfront.net/SilentInstaller_dotnet2.exe  (8eba2b9abda73727e4ea319f61e0ebf2)

1 / 68      (PUP)
http://d21m4u3yvwhf8i.cloudfront.net/prepreinstaller_win.exe  (zlypxmhugm.exe)

0 / 68
http://d21m4u3yvwhf8i.cloudfront.net/SilentInstaller_dotnet4.exe  (sdfa337.exe)

5 / 68      (PUP)
http://d21m4u3yvwhf8i.cloudfront.net/SilentInstaller_dotnet2.exe  (6ca34cf41cad5481bce57764fa48bbc6)

The following 342 files have been seen to comunicate with d21m4u3yvwhf8i.cloudfront.net in live environments.

TCP » 54.192.19.168:443
u1603.exe

TCP » 54.192.19.82:80
cfhelp66.exe

TCP » 54.192.19.11:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 54.192.19.11:80
UCBrowser.exe (by UCWeb)

TCP » 54.192.19.192:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 54.192.19.58:80
smu.exe (W by Search Module)

TCP » 54.192.19.58:80
smu.exe (W by Search Module)

TCP » 54.192.19.166:443
online-guardian-v2.0.9.exe

TCP » 54.192.19.122:80
browser.exe (Browser)

TCP » 54.192.19.215:80
saber.exe

TCP » 54.192.19.70:443
1stbrowser.exe (1stBrowser by The 1stBrowser Authors)

TCP » 54.192.19.9:80
ed2k.exe (aMuleall by http://www.amuleall.org/)

TCP » 54.192.19.192:80
saber.exe

TCP » 54.192.19.166:80
spassist.exe (SoftPlanet Software Assistant by Secure Download)

TCP » 54.192.19.27:443
new_chrome.exe (1stBrowser by The 1stBrowser Authors)

TCP » 54.192.19.230:80
ContentFinder.exe (ContentFinder by ContentFinder Software)

TCP » 54.192.19.168:443
new_chrome.exe (1stBrowser by The 1stBrowser Authors)

TCP » 54.192.19.230:80
browserairexec.exe (BrowserAir by Goobzo)

TCP » 54.192.19.215:80
browserairexec.exe (BrowserAir by Goobzo)

TCP » 54.192.19.82:80
interhop.exe

 
Latest 20 of 752 files

URL:
http://d21m4u3yvwhf8i.cloudfront.net/

Network:
Amazon Cloudfront

SSL certificate subject:
CN=*.cloudfront.net, O="Amazon.com, Inc.", L=Seattle, S=Washington, C=US

SSL certificate issuer:
CN=Symantec Class 3 Secure Server CA - G4, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Web server:
AmazonS3

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.