The domain d2drfrdurj6mvo.cloudfront.net registered by Amazon.com, Inc was initially registered in April of 2008 through MARKMONITOR INC.. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Dulles, Virginia within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Cloudfront CDN service which utilizes a number of proxy IP Addresses (see below).
Registrant:
Amazon.com, Inc
Registrar:
MARKMONITOR INC.
Server location:
Virginia, United States (US)
Create date:
Friday, April 25, 2008
Expires date:
Tuesday, April 25, 2017
Updated date:
Tuesday, February 25, 2014
ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US
Scanner detections:
Detections (92% detected)
Scan engine
Details
Detections
Reason Heuristics
PUP.FuyuanZhou, PUP.Ma Lin, PUP.Li Mo, Threat.Installer.FuyuanZhou, Threat.Li Mo.XiaoqingLiu, Threat.Ma Lin.TaimingLi, Threat.Ma Lin.ShulanHou, PUP.Ma Lin.ShulanHou, PUP.Ma Lin.ShulanHou (M), PUP.ZhuoLi.Installer (M), PUP.Thinknice.ThinkniceCo (M), PUP.ELEX.MinidigitalTechnologyCo (M), Adware.iStartSurf.Search (M), PUP.CHAODONGXIAO (M), PUP.ELEX.YuxinWANG.Installer (M), PUP.Thinknice.GinerTech.Installer (M), PUP.ELEX.XiaoqingLiu (M), PUP.ELEX.YuxinWANG (M), PUP.ELEX.SkytouchTechnologyCo (M), PUP.ELEX.Minidigi (M), PUP.ELEX.Xiaoqing (M), PUP.ELEX.ShulanHo (M), PUP.ELEX.YuxinWAN (M), PUP.ELEX.LiMo (M), PUP.ELEX.TaimingL (M), PUP.MyStartSearch.7th77777.Meta (M), Threat.Win.Reputation.IMP, PUP.ELEX.Skytouch (M), PUP.FuyuanZh (M)
97.78%
Malwarebytes
PUP.Optional.Omniboxes.A, PUP.Optional.ELEX, PUP.Optional.MyStartSearch.A, PUP.Optional.LuckySearches.A, PUP.Optional.IStartSurf.A, PUP.Optional.IStartSurf.ShrtCln
40.00%
Dr.Web
Adware.Mutabaha.220, Adware.Mutabaha.219, Adware.Mutabaha.228, Adware.Mutabaha.190, Adware.Mutabaha.288, Adware.Mutabaha.325
35.56%
Baidu Antivirus
Adware.Win32.ELEX, PUA.Win32.LiMo
31.11%
K7 AntiVirus
Unwanted-Program , Adware , Trojan , Riskware
26.67%
ESET NOD32
Win32/ELEX.CE potentially unwanted (variant), Win32/ELEX.CF potentially unwanted (variant), Win32/LiMo.C potentially unwanted (variant)
22.22%
Bkav FE
W32.HfsAdware
22.22%
Sophos
Elex, PUA 'Elex' (of type Adware)
20.00%
Fortinet FortiGate
W32/ELEX.CE, Riskware/Elex, W32/ELEX.CF
20.00%
herdProtect (fuzzy)
a variant of 71cbac51724310b59b79648244c7920ab7b415aa, a variant of 627de963ecccbc5b879a1503989ee2e555b6c0f2, a variant of 57531a3ae92b775106b5b5e3ffa5322e0cf55415
20.00%
ESET NOD32
Win32/ELEX.CF potentially unwanted application, Win32/ELEX.CE potentially unwanted application, Win32/LiMo.C potentially unwanted application, Win32/Parite.B virus
15.56%
VIPRE Antivirus
BehavesLike.Win32.Malware.sfd (mx-v), Threat.219451, Trojan.Win32.Generic, Threat.46249
13.33%
Agnitum Outpost
Riskware.Agent, PUA.Downloader
13.33%
avast!
Win32:Malware-gen, Win32:Evo-gen [Susp], Win32:Adware-gen [Adw], Win32:Oncer, Win32:Parite
11.11%
AVG
Potentially harmful program Downloader, Generic, Elex
11.11%
The domain d2drfrdurj6mvo.cloudfront.net has been seen to resolve to the following 279 IP addresses.
server-52-84-125-127.iad16.r.cloudfront.net
August 29, 2016
server-54-192-19-50.iad12.r.cloudfront.net
August 29, 2016
server-54-192-19-19.iad12.r.cloudfront.net
August 29, 2016
server-54-192-19-7.iad12.r.cloudfront.net
August 29, 2016
server-54-192-19-211.iad12.r.cloudfront.net
August 29, 2016
server-54-192-19-168.iad12.r.cloudfront.net
August 29, 2016
server-54-192-19-154.iad12.r.cloudfront.net
August 29, 2016
server-54-192-19-128.iad12.r.cloudfront.net
August 29, 2016
server-54-192-19-74.iad12.r.cloudfront.net
August 29, 2016
server-52-84-125-123.iad16.r.cloudfront.net
August 23, 2016
server-52-84-125-115.iad16.r.cloudfront.net
August 23, 2016
server-52-84-125-237.iad16.r.cloudfront.net
August 23, 2016
server-52-84-125-235.iad16.r.cloudfront.net
August 23, 2016
server-52-84-125-221.iad16.r.cloudfront.net
August 23, 2016
server-52-84-125-217.iad16.r.cloudfront.net
August 23, 2016
server-52-84-125-180.iad16.r.cloudfront.net
August 23, 2016
server-52-84-125-207.iad16.r.cloudfront.net
July 24, 2016
server-52-84-125-167.iad16.r.cloudfront.net
July 24, 2016
server-52-84-125-158.iad16.r.cloudfront.net
July 24, 2016
server-52-84-125-130.iad16.r.cloudfront.net
July 24, 2016
server-52-84-125-40.iad16.r.cloudfront.net
July 24, 2016
server-52-84-125-243.iad16.r.cloudfront.net
July 24, 2016
server-52-85-131-251.iad53.r.cloudfront.net
July 24, 2016
server-52-85-131-227.iad53.r.cloudfront.net
July 24, 2016
server-52-85-131-193.iad53.r.cloudfront.net
July 24, 2016
server-52-85-131-150.iad53.r.cloudfront.net
July 24, 2016
server-52-85-131-108.iad53.r.cloudfront.net
July 24, 2016
server-52-85-131-15.iad53.r.cloudfront.net
July 24, 2016
server-52-85-131-8.iad53.r.cloudfront.net
July 24, 2016
server-52-84-125-245.iad16.r.cloudfront.net
July 19, 2016
Showing 30 of 279 IP Addresses
File downloads found at URLs served by d2drfrdurj6mvo.cloudfront.net.
The following 405 files have been seen to comunicate with d2drfrdurj6mvo.cloudfront.net in live environments.
URL:
http://d2drfrdurj6mvo.cloudfront.net/
Network:
Amazon Cloudfront
SSL certificate subject:
CN=*.cloudfront.net, O="Amazon.com, Inc.", L=Seattle, S=Washington, C=US
SSL certificate issuer:
CN=Symantec Class 3 Secure Server CA - G4, OU=Symantec Trust Network, O=Symantec Corporation, C=US