home

download.mp3jam.org

Domains By Proxy, LLC  (Proxy Registrant)

Domain Information

The domain download.mp3jam.org is registered by proxy through GoDaddy.com, LLC. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in New York City, New York within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Cloudfront CDN service which utilizes a number of proxy IP Addresses (see below).
Registrar:
GoDaddy.com, LLC

Server location:
New York, United States (US)

Root domain:
mp3jam.org

Whois:
3 mp3jam.org records

Scanner detections:
Detections  (87% detected)

Scan engine
Details
Detections

ESET NOD32
Win32/Somoto, Win32/DownloadGuide (variant), Win32/InstallCore.QL (variant), Win32/InstallCore.QO (variant), Win32/InstallCore.RA (variant), Win32/InstallCore.TL potentially unwanted (variant)
93.33%

Reason Heuristics
PUP.Somoto.Bundle, PUP.Installer.CyberservicesBV.L, PUP.InstallCore.ENG (M)
66.67%

Trend Micro House Call
TROJ_GEN.F47V0220, Suspicious_GEN.F47V1113
53.33%

Avira AntiVirus
ADWARE/InstallCore.Gen9, PUA/InstallCore.Gen
40.00%

Fortinet FortiGate
Riskware/DownloadGuide, Riskware/InstallCore
20.00%

McAfee
Artemis!09FC65AF0006, Artemis!FF9D519D9728
13.33%

IKARUS anti.virus
AdWare.DownloadGuide, PUA.InstallCore
13.33%

AVG
Generic_r, OpenCandy
13.33%

Sophos
Generic PUA AI, Generic PUA OK
13.33%

Total Defense
Win32/Tnega.VBMKZGD
6.67%

Agnitum Outpost
Riskware.Agent
6.67%

F-Secure
Adware:W32/Buzzrin
6.67%

VIPRE Antivirus
DownloadGuide
6.67%

ESET NOD32
Win32/OpenCandy potentially unsafe application
6.67%

Dr.Web
Threat.Undefined
6.67%

The domain download.mp3jam.org has been seen to resolve to the following 86 IP addresses.

216.137.33.253
server-216-137-33-253.iad2.r.cloudfront.net
February 21, 2015

54.230.100.174
server-54-230-100-174.iad2.r.cloudfront.net
February 21, 2015

54.230.100.25
server-54-230-100-25.iad2.r.cloudfront.net
February 21, 2015

54.192.101.118
server-54-192-101-118.iad2.r.cloudfront.net
February 21, 2015

54.192.101.112
server-54-192-101-112.iad2.r.cloudfront.net
February 21, 2015

54.192.101.73
server-54-192-101-73.iad2.r.cloudfront.net
February 14, 2015

216.137.33.108
server-216-137-33-108.iad2.r.cloudfront.net
February 14, 2015

54.230.102.229
server-54-230-102-229.iad2.r.cloudfront.net
February 14, 2015

54.230.102.214
server-54-230-102-214.iad2.r.cloudfront.net
February 14, 2015

54.192.101.108
server-54-192-101-108.iad2.r.cloudfront.net
November 1, 2014

54.192.101.67
server-54-192-101-67.iad2.r.cloudfront.net
November 1, 2014

216.137.33.235
server-216-137-33-235.iad2.r.cloudfront.net
November 1, 2014

216.137.33.89
server-216-137-33-89.iad2.r.cloudfront.net
November 1, 2014

54.230.103.136
server-54-230-103-136.iad2.r.cloudfront.net
November 1, 2014

54.230.102.208
server-54-230-102-208.iad2.r.cloudfront.net
November 1, 2014

54.230.101.65
server-54-230-101-65.iad2.r.cloudfront.net
November 1, 2014

54.230.100.84
server-54-230-100-84.iad2.r.cloudfront.net
November 1, 2014

54.230.103.217
server-54-230-103-217.iad2.r.cloudfront.net
September 7, 2014

54.230.103.100
server-54-230-103-100.iad2.r.cloudfront.net
September 7, 2014

54.230.102.155
server-54-230-102-155.iad2.r.cloudfront.net
September 7, 2014

54.230.102.35
server-54-230-102-35.iad2.r.cloudfront.net
September 7, 2014

54.230.100.140
server-54-230-100-140.iad2.r.cloudfront.net
September 7, 2014

216.137.33.232
server-216-137-33-232.iad2.r.cloudfront.net
September 7, 2014

54.230.103.242
server-54-230-103-242.iad2.r.cloudfront.net
September 7, 2014

54.230.102.112
server-54-230-102-112.iad2.r.cloudfront.net
August 16, 2014

54.230.101.250
server-54-230-101-250.iad2.r.cloudfront.net
August 16, 2014

216.137.33.123
server-216-137-33-123.iad2.r.cloudfront.net
August 16, 2014

216.137.33.105
server-216-137-33-105.iad2.r.cloudfront.net
August 16, 2014

54.230.103.209
server-54-230-103-209.iad2.r.cloudfront.net
August 16, 2014

54.230.103.112
server-54-230-103-112.iad2.r.cloudfront.net
August 16, 2014

 
Showing 30 of 86 IP Addresses

File downloads found at URLs served by download.mp3jam.org.

6 / 68      (PUP)
http://download.mp3jam.org/MP3jamSetup.exe  (freemake.exe)

3 / 68      (PUP)
http://download.mp3jam.org/MP3jamSetup.exe  (105ea75e75daf8a1fbb90fe59fa5b450)

4 / 68
http://download.mp3jam.org/MP3jamCleanSetup.exe  (mp3jamsetup.exe)

3 / 68      (PUP)
http://download.mp3jam.org/MP3jamSetup.exe  (freemake.exe)

7 / 68      (PUP)
http://download.mp3jam.org/MP3jamSetup.exe  (ff9d519d972851def8ceae03250d61f4)

5 / 68      (PUP)
http://download.mp3jam.org/MP3jamSetup.exe  (6a12afcc1f371abf4213af5abe815792)

3 / 68      (inconclusive)
http://download.mp3jam.org/MP3jamSetup.exe  (icreinstall_mp3jamsetup.exe)

3 / 68      (PUP)
http://download.mp3jam.org/MP3jamSetup.exe  (3d40a4068c0f4fe5da8f9392d98e9021)

10 / 68    (Adware)
http://download.mp3jam.org/MP3jamSetup.exe  (09fc65af0006bed65ab4c18e30816bfc)

3 / 68      (PUP)
http://download.mp3jam.org/MP3jamSetup.exe  (4d308276d6ded30485af66270f60f79d)

3 / 68      (PUP)
http://download.mp3jam.org/MP3jamSetup.exe  (6953c57576fa50f5f6eb2db9e85f0f7e)

2 / 68      (PUP)
http://download.mp3jam.org/MP3jamSetup.exe  (mp3jamsetup_1.1.1.3.exe)

3 / 68      (PUP)
http://download.mp3jam.org/MP3jamSetup.exe  (0984c6ee6160d699f1767c1407aae13b)

3 / 68      (PUP)
http://download.mp3jam.org/MP3jamSetup.exe  (1283b19a7d51c4e5e7211dffa8305eaa)

2 / 68      (PUP)
http://download.mp3jam.org/MP3jamSetup.exe  (a88757fec25e2abc12d0b380de06a6b5)

The following 25 files have been seen to comunicate with download.mp3jam.org in live environments.

TCP » 54.230.55.31:443
UCBrowser.exe (by UCWeb)

TCP » 54.230.37.181:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 54.230.37.181:80
bbqleadsapplication.exe (NpApplication by Microsoft)

TCP » 216.137.33.105:80
Client.exe

TCP » 216.137.33.235:80
CollbeeService.exe (CollbeeService)

TCP » 54.230.100.174:80
DesktopWeatherAlertsApp.exe (DesktopWeatherAlertsApp)

TCP » 54.230.102.155:80
ContentExplorer.exe (ContentExplorer)

TCP » 54.230.102.35:80
raptr.exe (Raptr by Raptr, Inc)

TCP » 54.230.103.112:80
avwebgrd.exe (Avira Product Family by Avira Operations GmbH & Co. KG)

TCP » 54.230.103.112:80
client.exe

TCP » 54.230.37.181:80
browser.exe (Browser)

TCP » 54.230.38.142:443
catwsprx.exe (CatWSPrx.exe by Catalytix Web Services)

TCP » 54.230.38.239:80
WajamInternetEnhancer.exe (Wajam Internet Enhancer by Wajam Internet Technologies)

TCP » 54.230.38.243:80
dcytdiegut_gutdu_setup.exe

TCP » 54.230.38.243:80
setup.exe (Java Runtime by Download Assistant)

TCP » 54.230.38.41:443
AmazonForWindowsWebview.exe (AmazonForWindowsWebview.Lib)

TCP » 54.230.39.18:80
netdownloader.exe

TCP » 54.230.39.46:80
sndappv2.exe (sndappv2.exe by Sendori)

TCP » 54.230.39.66:80
amisetup0210__10235.exe

TCP » 54.230.39.73:80
StormAlertsApp.exe (StormAlertsApp)

 
Latest 20 of 26 files

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.