The domain dl.safemonitorapp.com is registered by proxy through GODADDY.COM, LLC and was originally registered in January of 2013. This domain has been known to host and distribute potentially unwanted software. The hosted servers are located in Dulles, Virginia within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Cloudfront CDN service which utilizes a number of proxy IP Addresses (see below). The domain is associated with the publisher WebAppTech Coding LLC who is located in Grandville, Michigan in the United States.
Registrar:
GODADDY.COM, LLC
Server location:
Virginia, United States (US)
Create date:
Saturday, January 19, 2013
Expires date:
Thursday, January 19, 2017
Updated date:
Wednesday, January 20, 2016
ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US
Scanner detections:
Detections (96% detected)
Scan engine
Details
Detections
Reason Heuristics
PUP.Installer.WesternWebApplications.F, PUP.Installer.WebAppTechCoding.F, PUP.LionSea.LionSeaS.Installer (M), PUP.Installer.WebAppTechCoding.I, DownloadManager.AirSoftware.F, PUP.Installer.Injekt, PUP.Injekt.WesternWebApplications.Installer (M), PUP.Injekt.WesternW.Installer (M), PUP.Softpulse (M)
97.92%
Dr.Web
Adware.Plugin.36, riskware program Program.Unwanted.79, is riskware program Program.Unwanted.79, Trojan.SMSSend.4766, infected with Trojan.Yontoo.2143
72.92%
VIPRE Antivirus
SearchDonkey, Injekt, Iminent, Threat.4784449
70.83%
ESET NOD32
Win32/ExFriendAlert (variant), MSIL/Adware.PullUpdate
56.25%
Trend Micro House Call
TROJ_GEN.F47V0601, TROJ_FAKEAV.BMC, TROJ_GE.269D89E4, TROJ_GE.7B758086, TROJ_GEN.F47V0324, TROJ_GE.0C72B010, TROJ_GEN.F47V1115, TROJ_GEN.F47V0603, TROJ_GE.CFFE2CD1, TROJ_GEN.F47V0623
43.75%
Malwarebytes
Trojan.Agent.HE, Adware.SaMon, PUP.Optional.Conduit.A, PUP.Optional.AirInstaller, PUP.Optional.SafeMonitor.A
41.67%
McAfee
Artemis!746F02AD95F1, Artemis!C2B4BC7A8347, Artemis!913B2DA85CD4, Artemis!B7689FE1B383, Artemis!5A7E0A5F30C1, Artemis!8E01FFB62C72, Artemis!BD101DACC599, Artemis!5DF05C1AE745, Artemis!B76C76ABE40E, Artemis!72CB9F4C5846, Artemis!311C6C38DBF2
31.25%
Comodo Security
Heur.Suspicious, ApplicUnwnt, Application.Win32.AirAdInstaller.A
31.25%
Vba32 AntiVirus
suspected of Trojan.Downloader.gen.h, TScope.Trojan.MSIL, AdWare.SaMon, AdWare.AirAdInstaller.ajov
29.17%
Agnitum Outpost
Riskware.Agent, PUA.PullUpdate, PUA.AirAd
29.17%
avast!
Win32:BHO-AMO [PUP], JS:BHO-O [PUP], JS:BHO-N [PUP], Adware-gen [Adw]
27.08%
IKARUS anti.virus
AdWare.Win32.ExFriendAlert, not-a-virus:AdWare.Win32.SaMon, AdWare.Agent, Win32.AdWare, PUA.ExFriendAlert, AdWare.MSIL.PullUpdate
25.00%
Kaspersky
not-a-virus:AdWare.Win32.SaMon, not-a-virus:AdWare.Win32.AirAdInstaller
12.50%
Sophos
Generic PUA BJ, Generic PUA KJ, Generic PUA HC, AirInstaller, PUA 'OpenCandy'
12.50%
K7 AntiVirus
Unwanted-Program , Trojan
12.50%
The domain dl.safemonitorapp.com has been seen to resolve to the following 186 IP addresses.
server-52-84-125-252.iad16.r.cloudfront.net
September 3, 2016
server-52-84-125-230.iad16.r.cloudfront.net
September 3, 2016
server-52-84-125-214.iad16.r.cloudfront.net
September 3, 2016
server-52-84-125-110.iad16.r.cloudfront.net
September 3, 2016
server-52-84-125-102.iad16.r.cloudfront.net
September 3, 2016
server-52-84-125-56.iad16.r.cloudfront.net
September 3, 2016
server-52-84-125-27.iad16.r.cloudfront.net
September 3, 2016
server-52-84-125-16.iad16.r.cloudfront.net
September 3, 2016
server-52-85-131-76.iad53.r.cloudfront.net
July 19, 2016
server-52-85-131-62.iad53.r.cloudfront.net
July 19, 2016
server-52-85-131-29.iad53.r.cloudfront.net
July 19, 2016
server-52-85-131-243.iad53.r.cloudfront.net
July 19, 2016
server-52-85-131-242.iad53.r.cloudfront.net
July 19, 2016
server-52-85-131-206.iad53.r.cloudfront.net
July 19, 2016
server-52-85-131-185.iad53.r.cloudfront.net
July 19, 2016
server-52-85-131-142.iad53.r.cloudfront.net
July 19, 2016
server-52-85-142-249.iad12.r.cloudfront.net
May 28, 2016
server-52-85-142-108.iad12.r.cloudfront.net
May 24, 2016
server-52-85-142-64.iad12.r.cloudfront.net
May 24, 2016
server-52-85-142-50.iad12.r.cloudfront.net
May 24, 2016
server-52-85-142-254.iad12.r.cloudfront.net
May 24, 2016
server-52-85-142-244.iad12.r.cloudfront.net
May 24, 2016
server-52-85-142-128.iad12.r.cloudfront.net
May 24, 2016
server-52-85-142-122.iad12.r.cloudfront.net
May 24, 2016
server-52-85-142-89.iad12.r.cloudfront.net
April 21, 2016
server-52-85-142-81.iad12.r.cloudfront.net
April 21, 2016
server-52-85-142-47.iad12.r.cloudfront.net
April 21, 2016
server-52-85-142-43.iad12.r.cloudfront.net
April 21, 2016
server-52-85-142-14.iad12.r.cloudfront.net
April 21, 2016
server-52-85-142-201.iad12.r.cloudfront.net
April 21, 2016
Showing 30 of 186 IP Addresses
File downloads found at URLs served by dl.safemonitorapp.com.
Latest 30 of 50 download URLs
The following 168 files have been seen to comunicate with dl.safemonitorapp.com in live environments.
URL:
http://dl.safemonitorapp.com/
Network:
Amazon Cloudfront
Related Domains