home

download.dablecdn.com

WHOISGUARD, INC.  (Proxy Registrant)

Domain Information

The domain download.dablecdn.com is registered by proxy through ENOM, INC. and was originally registered in July of 2014. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Dulles, Virginia within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Cloudfront CDN service which utilizes a number of proxy IP Addresses (see below).
Registrar:
ENOM, INC.

Server location:
Virginia, United States (US)

Create date:
Wednesday, July 16, 2014

Expires date:
Thursday, July 16, 2015

Updated date:
Wednesday, July 16, 2014

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
dablecdn.com

Whois:
1 dablecdn.com record

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

McAfee
Adware-OpenCandy.a, Artemis!27CCE7D17575, Artemis!FD332B94A886, Artemis!1A3AEA6E64D6
100.00%

Malwarebytes
PUP.Optional.OpenCandy
100.00%

Trend Micro House Call
Suspici.F184F561, Suspicious_GEN.F47V0721, Suspicious_GEN.F47V0722
100.00%

VIPRE Antivirus
Opencandy
100.00%

ESET NOD32
Win32/JoyDownloader
100.00%

AVG
Generic
100.00%

Reason Heuristics
PUP.InnovativeSystems.Q, PUP.InnovativeSystems.R, PUP.InnovativeSystems.N, PUP.InnovativeSystems.S, PUP.InnovativeSystems.H
100.00%

avast!
Win32:Adware-gen [Adw]
50.00%

Sophos
Generic PUA FH, Generic PUA CO
50.00%

IKARUS anti.virus
PUA.JoyDownloader
33.33%

Comodo Security
ApplicUnwnt
16.67%

AhnLab V3 Security
PUP/Win32.OpenCandy
16.67%

Agnitum Outpost
Riskware.Agent
16.67%

Dr.Web
Adware.Downware.6712
16.67%

The domain download.dablecdn.com has been seen to resolve to the following 43 IP addresses.

54.230.194.208
server-54-230-194-208.iad53.r.cloudfront.net
December 9, 2014

54.230.193.226
server-54-230-193-226.iad53.r.cloudfront.net
December 9, 2014

54.230.193.225
server-54-230-193-225.iad53.r.cloudfront.net
December 9, 2014

54.230.193.137
server-54-230-193-137.iad53.r.cloudfront.net
December 9, 2014

54.230.193.45
server-54-230-193-45.iad53.r.cloudfront.net
December 9, 2014

54.230.192.213
server-54-230-192-213.iad53.r.cloudfront.net
December 9, 2014

216.137.33.187
server-216-137-33-187.iad2.r.cloudfront.net
December 1, 2014

54.230.103.81
server-54-230-103-81.iad2.r.cloudfront.net
December 1, 2014

54.230.103.20
server-54-230-103-20.iad2.r.cloudfront.net
December 1, 2014

54.230.100.247
server-54-230-100-247.iad2.r.cloudfront.net
December 1, 2014

54.192.101.109
server-54-192-101-109.iad2.r.cloudfront.net
December 1, 2014

54.192.101.82
server-54-192-101-82.iad2.r.cloudfront.net
December 1, 2014

54.192.101.81
server-54-192-101-81.iad2.r.cloudfront.net
December 1, 2014

54.230.19.119
server-54-230-19-119.iad12.r.cloudfront.net
September 7, 2014

54.230.19.89
server-54-230-19-89.iad12.r.cloudfront.net
September 7, 2014

54.230.18.72
server-54-230-18-72.iad12.r.cloudfront.net
September 7, 2014

54.230.17.39
server-54-230-17-39.iad12.r.cloudfront.net
September 7, 2014

54.230.16.177
server-54-230-16-177.iad12.r.cloudfront.net
September 7, 2014

54.230.16.80
server-54-230-16-80.iad12.r.cloudfront.net
September 7, 2014

54.240.160.220
server-54-240-160-220.iad12.r.cloudfront.net
September 7, 2014

54.240.160.58
server-54-240-160-58.iad12.r.cloudfront.net
September 7, 2014

54.230.18.129
server-54-230-18-129.iad12.r.cloudfront.net
September 5, 2014

54.230.17.22
server-54-230-17-22.iad12.r.cloudfront.net
September 5, 2014

54.230.16.138
server-54-230-16-138.iad12.r.cloudfront.net
September 5, 2014

54.230.16.111
server-54-230-16-111.iad12.r.cloudfront.net
September 5, 2014

54.230.16.23
server-54-230-16-23.iad12.r.cloudfront.net
September 5, 2014

54.240.160.94
server-54-240-160-94.iad12.r.cloudfront.net
September 5, 2014

54.240.160.23
server-54-240-160-23.iad12.r.cloudfront.net
September 5, 2014

54.230.19.11
server-54-230-19-11.iad12.r.cloudfront.net
September 5, 2014

54.230.100.6
server-54-230-100-6.iad2.r.cloudfront.net
September 5, 2014

 
Showing 30 of 43 IP Addresses

File downloads found at URLs served by download.dablecdn.com.

7 / 68      (Adware)
http://download.dablecdn.com/get_file_for_cdn/13/13/1/.../KMPlayer_v3.8.0.117.exe  (e6ced2e7ceac8455eb4c21e1d974fe2c)

12 / 68    (Adware)
http://download.dablecdn.com/get_file_for_cdn/13/13/1/.../CreativeCloudSet-Up.exe  (1a3aea6e64d63aaba92efe9518360e63)

10 / 68    (Adware)
http://download.dablecdn.com/get_file_for_cdn/13/13/1/.../vlc-2.1.3-win32.exe  (27cce7d175759cf312ead94b6edd19a0)

10 / 68    (Adware)
http://download.dablecdn.com/get_file_for_cdn/13/13/1/.../Viber 4.exe  (41b901315ac6f37c0f63d09dc21942a7)

8 / 68      (Adware)
http://download.dablecdn.com/get_file_for_cdn/13/13/1/.../AdbeRdr11007_en_US.exe  (fd332b94a886aa845ecd80814257efb2)

7 / 68      (Adware)
http://download.dablecdn.com/get_file_for_cdn/13/13/1/.../daemon-tools-4.48.1.exe  (64f657c4954ece5c5fcbb0c6466bf6be)

The following 14 files have been seen to comunicate with download.dablecdn.com in live environments.

TCP » 54.230.193.137:443
online-guardian-v2.0.9.exe

TCP » 54.230.193.137:443
online-guardian-v2.0.9.exe

TCP » 216.137.33.120:443
Client.exe

TCP » 54.230.102.35:80
raptr.exe (Raptr by Raptr, Inc)

TCP » 54.230.103.112:80
avwebgrd.exe (Avira Product Family by Avira Operations GmbH & Co. KG)

TCP » 54.230.103.112:80
client.exe

TCP » 54.230.16.111:80
sndappv2.exe (sndappv2.exe by Sendori)

TCP » 54.230.16.177:443
u.exe

TCP » 54.230.16.80:80
pcpitstoprtservice.exe (PC Pitstop SuperShield by PC Pitstop)

TCP » 54.230.18.129:80
PastaLeadsService.exe (PastaLeadsService)

TCP » 54.230.18.129:443
u.exe

TCP » 54.230.193.225:80
new_chrome.exe (Google Chrome by Google)

TCP » 54.230.193.226:80
csrcc.exe

TCP » 54.230.194.208:80
ctfmon.exe

TCP » 54.240.160.94:80
zaevine.exe (Maskiseft Visual Studio 2010 by Maskiseft)

URL:
http://download.dablecdn.com/

Network:
Amazon Cloudfront

Web server:
CloudFront

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.