downprov2.dynadownload.com

Whois Privacy Corp.

Domain Information

The domain downprov2.dynadownload.com registered by Whois Privacy Corp. was initially registered in October of 2014 through INTERNET.BS CORP.. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Singapore, Singapore within Singapore which resides on the CloudFlare, Inc. network. The domain uses the CloudFlare CDN, a distributed domain name server service which utilizes a number of reverse proxy IP Addresses (see below).
Registrar:
INTERNET.BS CORP.

Server location:
Singapore, Singapore (SG)

Create date:
Sunday, October 12, 2014

Expires date:
Monday, October 12, 2015

Updated date:
Sunday, October 12, 2014

ASN:
AS13335 CLOUDFLARENET - CloudFlare, Inc.,US

Root domain:

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Amonetize (M), Adware.Amonetize.ET (M), PUP.Amonetize.TECHNOIN.Bundler (M), Adware.Amonetize.DB (M)
79.59%

Dr.Web
infected with Trojan.Amonetize.353, Trojan.Amonetize.2503, infected with Trojan.Amonetize.2503, Detection.Undefined
77.55%

McAfee
Artemis!8F00B3F9F161, RDN/Generic PUP.x!cww, RDN/Generic PUP.z, Trojan.Artemis!17C2A5C4DC45, Program.Artemis!EEE7AA129D82, Trojan.Artemis!D46A2405532A, Artemis!D03BB9A6EE55, RDN/Generic PUP.x!csj
77.55%

VIPRE Antivirus
Threat.4150696, Trojan.Win32.Generic, Threat.4657539, Trojan.Win32.Generic.pak!cobra
71.43%

Clam AntiVirus
Win.Adware.Amonetize-511, Win.Adware.Amonetize-703
65.31%

G Data
NSIS.Application.Crypted, Win32.Application.Agent.RCEZAU
59.18%

AVG
Generic
59.18%

Malwarebytes
PUP.Optional.Amonetize
57.14%

Kaspersky
not-a-virus:HEUR:AdWare.Win32.Amonetize
57.14%

Trend Micro House Call
Suspici.1CC0D1BF, TROJ_GEN.R047H07A615, TROJ_GEN.R08NH07LV14, TROJ_GE.28D9CDA2, TROJ_GEN.R047H07A315, TROJ_SPNR.08A015, TROJ_GEN.R0C1H07LV14
53.06%

Panda Antivirus
Generic Suspicious, Trj/CI.A, Trj/OCJ.F
46.94%

ESET NOD32
Win32/Amonetize.CW potentially unwanted application, Win32/Amonetize.CT potentially unwanted application
44.90%

Avira AntiVirus
Adware/Amonetize.307737, Adware/Amonetize.307740, Adware/AgentCV.A.119, ADWARE/AgentCV.A.119, Adware/Amonetize.307763, Adware/Amonetize.307635.1
38.78%

Baidu Antivirus
Adware.Win32.Amonetize, PUA.Win32.Amonetize
38.78%

Rising Antivirus
PE:Trojan.Win32.Generic.17E4A8DF!400861407, PE:AdWare.Win32.Adpeak.c!1075356117, PE:Trojan.Win32.Generic.17E18682!400656002
34.69%

The domain downprov2.dynadownload.com has been seen to resolve to the following 2 IP addresses.

May 5, 2015

January 19, 2015

File downloads found at URLs served by downprov2.dynadownload.com.

21 / 68    (PUP)

2 / 68      (PUP)

21 / 68    (PUP)
http://downprov2.dynadownload.com/.../ps vita jailbreak cfw password.txt_10924_i12643257_il345.exe  ([multi] retour à la fac [multilangue] [bluray 1080p]_10924_i12644802_il345.exe)

20 / 68    (PUP)

12 / 68    (PUP)

22 / 68    (PUP)

2 / 68      (PUP)
http://downprov2.dynadownload.com/.../Lord of the Rings:Battle for Middle Earth II torrent_10924_i12521094_il345.exe  (lord of the rings-battle for middle earth ii torrent_10924_i12521094_il345.exe)

3 / 68      (PUP)
http://downprov2.dynadownload.com/.../Lord of the Rings:Battle for Middle Earth II torrent_10924_i12533564_il345.exe  (lord of the rings-battle for middle earth ii torrent_10924_i12533564_il345.exe)

3 / 68      (PUP)

12 / 68    (PUP)

4 / 68      (PUP)

23 / 68    (PUP)

2 / 68      (PUP)
http://downprov2.dynadownload.com/.../???????? ????????? ?? ?? ..._10924_i12066009_il345.exe  (напарник брокгауза по сл..._10924_i12066009_il345.exe)

3 / 68      (PUP)

15 / 68    (PUP)
http://downprov2.dynadownload.com/.../id21b15.MR. .HERO.rar_10924_i11980561_il345.exe  (spore cracked download full_10924_i11981409_il345.exe)

 
Latest 30 of 61 download URLs

URL:
http://downprov2.dynadownload.com/

SSL certificate subject:
CN=sni21209.cloudflaressl.com, OU=PositiveSSL Multi-Domain, OU=Domain Control Validated

SSL certificate issuer:
CN=COMODO ECC Domain Validation Secure Server CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Web server:
cloudflare-nginx