home

demo.ovh.eu

NOT DISCLOSED!  (Proxy Registrant)

Domain Information

The domain demo.ovh.eu is registered by proxy through OVH SAS. The hosted servers are located in Roubaix, Nord-Pas-De-Calais within France which resides on the RIPE Network Coordination Centre network.
Registrar:
OVH SAS

Server location:
Nord-Pas-De-Calais, France (FR)

ASN:
AS16276 OVH OVH Systems

Root domain:
ovh.eu

Whois:
1 ovh.eu record

The domain demo.ovh.eu has been seen to resolve to the following 2 IP addresses.

213.186.33.5
redirect.ovh.net
April 9, 2016

188.165.12.227
ns62039.ovh.net
August 17, 2014

File downloads found at URLs served by demo.ovh.eu.

35 / 68    (Malware)
http://demo.ovh.eu/download/.../flashplayer.exe  (15f47d6bec2d341a5d61d36a64c8e500)

4 / 68      (Malware)
http://demo.ovh.eu/download/.../Generateur.exe  (436a0a2d90b778cc24a032f60b02c796)

0 / 68
http://demo.ovh.eu/download/.../Setup.exe  (dcb96d276228449e6fa0f1c1d7e81222)

0 / 68
http://demo.ovh.eu/download/.../Plutocheat_V5.1.exe  (dce2582f796f95c61021b54a7e5c46f5)

0 / 68
http://demo.ovh.eu/.../404  (404.htm)

1 / 68      (inconclusive)
http://demo.ovh.eu/download/.../Generateur.exe  (biosmonitor.exe)

0 / 68
http://demo.ovh.eu/download/.../ddos_dofus.exe  (bc4c9f96e8aa41242585866438b5cb28)

1 / 68
http://demo.ovh.eu/download/.../flashplayer20_ha_install.exe  (9efd4aecafd08c36e4087e3b49593ec7)

7 / 68      (Malware)
http://demo.ovh.eu/download/.../Dobre-suas-Vendas-em-8-Semanas.pdf.exe  (8ba1ed8e25a30453347f491cc1930ea6)

1 / 68
http://demo.ovh.eu/download/.../flashplayer20_ha_install.exe  (8fb0e11f0e5d26280d607e6d224143a0)

0 / 68
http://demo.ovh.eu/download/.../CsgoKeys_Setup.exe  (7d329856c32499b171cda33d3ad32d93)

23 / 68    (Malware)
http://demo.ovh.eu/download/.../CsgoKeys_Setup.exe  (d76359886159523a8c082ff37d3b7423)

27 / 68    (Malware)
http://demo.ovh.eu/download/.../Video009.exe  (5cfc4607789c0a12df229f525d265a24)

The following 20 files have been seen to comunicate with demo.ovh.eu in live environments.

TCP » 213.186.33.5:25
init.exe

TCP » 213.186.33.5:80
ContentSinder.exe (ContentSinder by ContentSinder Company)

TCP » 213.186.33.5:25
www.exe

TCP » 213.186.33.5:80
ContentFinder.exe (ContentFinder by DigitalSoftware Group)

TCP » 213.186.33.5:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 213.186.33.5:25
wrk.exe

TCP » 213.186.33.5:80
usbfix.exe

TCP » 213.186.33.5:25
vrt63.tmp

TCP » 213.186.33.5:80
usbfix.exe

TCP » 213.186.33.5:25
7eda.tmp.exe

TCP » 213.186.33.5:80
ContentFinder.exe (ContentFinder by ContentFinder Company)

TCP » 213.186.33.5:80
ContentFinder.exe (ContentFinder by ContentFinder Software)

TCP » 213.186.33.5:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 213.186.33.5:25
kb43070331.exe

TCP » 213.186.33.5:25
temp3501895252.exe

TCP » 213.186.33.5:25
w.exe

TCP » 213.186.33.5:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 213.186.33.5:80
cfuwxqqr.exe

TCP » 213.186.33.5:25
init.exe

TCP » 213.186.33.5:80
UCBrowser.exe (UC Browser by UCWeb)

 
Latest 20 of 20 files

URL:
http://demo.ovh.eu/

Web server:
nginx

Facebook:
Likes:  8
Shares:  59
Comments:  4

Statistics are for the previous month.

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.