home

d22z5jqfvuej9a.cloudfront.net

Amazon.com, Inc

Domain Information

The domain d22z5jqfvuej9a.cloudfront.net registered by Amazon.com, Inc was initially registered in April of 2008 through MARKMONITOR INC.. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Dulles, Virginia within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Cloudfront CDN service which utilizes a number of proxy IP Addresses (see below).
Registrar:
MARKMONITOR INC.

Server location:
Virginia, United States (US)

Create date:
Friday, April 25, 2008

Expires date:
Tuesday, April 25, 2017

Updated date:
Tuesday, February 25, 2014

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
cloudfront.net

Whois:
1 cloudfront.net record

Scanner detections:
Detections  (75% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Optional.Installer.BeijingAmazGameAgeInternetTechnologyCo.Y, PUP.PriceGong.O, PUP.PCUtilities.M, PUP.Installer.BeijingAmazGameAgeInternetTechnologyCo.Y, PUP.AnchorFree.Installer.Meta (L)
88.89%

Dr.Web
Adware.NextLive.2, Adware.Shopper.327, riskware program Program.Unwanted.29, Adware.Downware.934, Threat.Undefined
66.67%

VIPRE Antivirus
Trojan.Win32.Generic, Adware.Agent, Jenkat Media
55.56%

AVG
MalSign.Generic, Toolbar.Babylon, Jenkatedia
55.56%

NANO AntiVirus
Trojan.Win32.Ramnit.cspjsp, Riskware.Win32.Unwanted.ccmwkx, Trojan.Win32.NextLive.csjhvj, Riskware.Nsis.Babylon.cwhyhv
44.44%

Trend Micro House Call
TROJ_GEN.F47V0809, TROJ_GEN.F47V0203, ADW_ADLOAD, Suspici.6FE060C2
44.44%

Malwarebytes
PUP.Optional.OptimizePro.A, PUP.Optional.NextLive.A, PUP.Optional.DeltaSearch.A
33.33%

herdProtect (fuzzy)
a variant of 21f8b8888acca3fe866d4cd68a070973e46e2fde, a variant of 61aa6cdd4b34e6dcf289408494ce9946ab052d08, a variant of 6036b6c758de964bb56973e1c63e737ae7b34173
33.33%

McAfee
Artemis!D84B92824CEE, Artemis!0E53810B8C8F, RDN/Generic.dx!czh
33.33%

Kaspersky
not-a-virus:RiskTool.Win32.Agent, not-a-virus:AdWare.Win32.Agent, Trojan-FakeAV.Win32.Agent
33.33%

Rising Antivirus
NS:Malware.Install!1.9F62, PE:Trojan.Win32.Generic.16594EEF!374951663
22.22%

Agnitum Outpost
Trojan.Agent, PUA.Toolbar.Babylon
22.22%

Fortinet FortiGate
W32/SpeedingUpMyPC.B, Riskware/DomaIQ
22.22%

Qihoo 360 Security
Malware.QVM06.Gen, Win32/Trojan.5f3
22.22%

K7 AntiVirus
Trojan
22.22%

The domain d22z5jqfvuej9a.cloudfront.net has been seen to resolve to the following 60 IP addresses.

52.84.125.18
server-52-84-125-18.iad16.r.cloudfront.net
July 24, 2016

52.84.125.195
server-52-84-125-195.iad16.r.cloudfront.net
July 24, 2016

52.84.125.159
server-52-84-125-159.iad16.r.cloudfront.net
July 24, 2016

52.84.125.151
server-52-84-125-151.iad16.r.cloudfront.net
July 24, 2016

52.84.125.146
server-52-84-125-146.iad16.r.cloudfront.net
July 24, 2016

52.84.125.103
server-52-84-125-103.iad16.r.cloudfront.net
July 24, 2016

52.84.125.99
server-52-84-125-99.iad16.r.cloudfront.net
July 24, 2016

52.84.125.20
server-52-84-125-20.iad16.r.cloudfront.net
July 24, 2016

52.85.131.30
server-52-85-131-30.iad53.r.cloudfront.net
July 18, 2016

52.85.131.24
server-52-85-131-24.iad53.r.cloudfront.net
July 18, 2016

52.85.131.236
server-52-85-131-236.iad53.r.cloudfront.net
July 18, 2016

52.85.131.180
server-52-85-131-180.iad53.r.cloudfront.net
July 18, 2016

52.85.131.178
server-52-85-131-178.iad53.r.cloudfront.net
July 18, 2016

52.85.131.89
server-52-85-131-89.iad53.r.cloudfront.net
July 18, 2016

52.85.131.75
server-52-85-131-75.iad53.r.cloudfront.net
July 18, 2016

52.85.131.33
server-52-85-131-33.iad53.r.cloudfront.net
July 18, 2016

52.85.142.163
server-52-85-142-163.iad12.r.cloudfront.net
May 17, 2016

52.85.142.149
server-52-85-142-149.iad12.r.cloudfront.net
May 17, 2016

52.85.142.113
server-52-85-142-113.iad12.r.cloudfront.net
May 17, 2016

52.85.142.101
server-52-85-142-101.iad12.r.cloudfront.net
May 17, 2016

52.85.142.41
server-52-85-142-41.iad12.r.cloudfront.net
May 17, 2016

52.85.142.221
server-52-85-142-221.iad12.r.cloudfront.net
May 17, 2016

52.85.142.202
server-52-85-142-202.iad12.r.cloudfront.net
May 17, 2016

52.85.142.192
server-52-85-142-192.iad12.r.cloudfront.net
May 17, 2016

52.85.131.72
server-52-85-131-72.iad53.r.cloudfront.net
May 17, 2016

52.85.131.184
server-52-85-131-184.iad53.r.cloudfront.net
May 17, 2016

52.85.131.144
server-52-85-131-144.iad53.r.cloudfront.net
May 17, 2016

52.85.131.133
server-52-85-131-133.iad53.r.cloudfront.net
May 17, 2016

52.85.131.131
server-52-85-131-131.iad53.r.cloudfront.net
May 17, 2016

52.85.131.127
server-52-85-131-127.iad53.r.cloudfront.net
May 17, 2016

 
Showing 30 of 60 IP Addresses

File downloads found at URLs served by d22z5jqfvuej9a.cloudfront.net.

0 / 68
http://d22z5jqfvuej9a.cloudfront.net/bundles/.../BavPro_Setup_Mini_294.exe  (bav_bt.exe)

15 / 68    (PUP)
http://d22z5jqfvuej9a.cloudfront.net/bundles/.../Delta_523.exe  (2868cd5440fadc6abc6a1dcb5bcdb0e2)

2 / 68      (Adware)
http://d22z5jqfvuej9a.cloudfront.net/bundles/.../PriceGong_2611.exe  (4f215ee78d21b7301526b7c8a36aa892)

14 / 68    (PUP)
http://d22z5jqfvuej9a.cloudfront.net/bundles/.../Mobogenie_Setup_2.1.37_666.exe  (0e53810b8c8fbd84840998d27d32b70a)

0 / 68
http://d22z5jqfvuej9a.cloudfront.net/bundles/.../winziprosetup-WZRO12.exe  (8ab781b65f1da93c420cbf955a0436af)

4 / 68      (PUP)
http://d22z5jqfvuej9a.cloudfront.net/bundles/.../Mobogenie_Setup_2.1.27_588.exe  (7f7cdf85c9aedd88c8f0cfee127ba77d)

4 / 68      (PUP)
http://d22z5jqfvuej9a.cloudfront.net/bundles/.../JGAASetup.1.4.0.exe  (2b95a4674e2a8a8330d4c03cff2718a5)

1 / 68      (PUP)
http://d22z5jqfvuej9a.cloudfront.net/bundles/.../HSS-2.76-install-plain-398-silent.exe  (c9efcd3b47cb9b6ff32fabbc43c6963f)

6 / 68      (PUP)
http://d22z5jqfvuej9a.cloudfront.net/bundles/.../aff_setup.exe  (aird8b9.exe)

3 / 68      (PUP)
http://d22z5jqfvuej9a.cloudfront.net/bundles/.../JGAASetup.1.5.0_20140911.exe  (172d7ed0fdf5a49cdd61717fdac714ba)

0 / 68
http://d22z5jqfvuej9a.cloudfront.net/bundles/.../chica_silent_2008.exe  (2d0ed69ccc58eeff3b3b38082a31c8cc)

21 / 68    (PUP)
http://d22z5jqfvuej9a.cloudfront.net/bundles/.../optimizerpro.exe  (ea54473db7769dc19eaa3236478f5752)

The following 26 files have been seen to comunicate with d22z5jqfvuej9a.cloudfront.net in live environments.

TCP » 52.84.125.146:443
browserairexec.exe (BrowserAir by Goobzo)

TCP » 52.85.131.30:443
browser.exe (Browser)

TCP » 52.85.142.149:443
citrio.exe (Citrio by CatalinaGroup)

TCP » 52.84.125.18:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.85.142.149:443
GPlayer.exe (by Exent Technologies)

TCP » 52.84.125.18:80
bobrowser.exe (BoBrowser by The BoBrowser Authors)

TCP » 52.84.125.99:80
citrio.exe (Citrio by CatalinaGroup)

TCP » 52.85.142.221:80
browser.exe (Browser)

TCP » 52.84.125.99:443
citrio.exe (Citrio by CatalinaGroup)

TCP » 52.84.125.146:443
UCBrowser.exe (by UCWeb)

TCP » 52.85.142.221:80
Mobogenie.exe (Mobogenie by Mobogenie.com)

TCP » 52.85.142.221:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.85.142.149:443
jingling.exe

TCP » 52.84.125.20:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.85.142.149:80
apptrailers.exe

TCP » 52.85.142.41:80
browser.exe (Browser)

TCP » 52.84.125.99:80
Trezaa.Service.exe (Trezaa.Service by Microsoft)

TCP » 52.85.142.221:443
online-guardian-v2.0.9.exe

TCP » 52.85.142.41:80
browser.exe (Browser)

TCP » 52.85.142.221:443
online-guardian-v2.0.9.exe

 
Latest 20 of 59 files

URL:
http://d22z5jqfvuej9a.cloudfront.net/

Network:
Amazon Cloudfront

SSL certificate subject:
CN=*.cloudfront.net, O="Amazon.com, Inc.", L=Seattle, S=Washington, C=US

SSL certificate issuer:
CN=Symantec Class 3 Secure Server CA - G4, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Web server:
CloudFront

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.