The domain downprov2.dynadownload.com registered by Whois Privacy Corp. was initially registered in October of 2014 through INTERNET.BS CORP.. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Singapore, Singapore within Singapore which resides on the CloudFlare, Inc. network. The domain uses the CloudFlare CDN, a distributed domain name server service which utilizes a number of reverse proxy IP Addresses (see below).
Registrant:
Whois Privacy Corp.
Registrar:
INTERNET.BS CORP.
Server location:
Singapore, Singapore (SG)
Create date:
Sunday, October 12, 2014
Expires date:
Monday, October 12, 2015
Updated date:
Sunday, October 12, 2014
ASN:
AS13335 CLOUDFLARENET - CloudFlare, Inc.,US
Scanner detections:
Detections (100% detected)
Scan engine
Details
Detections
Reason Heuristics
PUP.Amonetize (M), Adware.Amonetize.ET (M), PUP.Amonetize.TECHNOIN.Bundler (M), Adware.Amonetize.DB (M)
79.59%
Dr.Web
infected with Trojan.Amonetize.353, Trojan.Amonetize.2503, infected with Trojan.Amonetize.2503, Detection.Undefined
77.55%
McAfee
Artemis!8F00B3F9F161, RDN/Generic PUP.x!cww, RDN/Generic PUP.z, Trojan.Artemis!17C2A5C4DC45, Program.Artemis!EEE7AA129D82, Trojan.Artemis!D46A2405532A, Artemis!D03BB9A6EE55, RDN/Generic PUP.x!csj
77.55%
VIPRE Antivirus
Threat.4150696, Trojan.Win32.Generic, Threat.4657539, Trojan.Win32.Generic.pak!cobra
71.43%
Clam AntiVirus
Win.Adware.Amonetize-511, Win.Adware.Amonetize-703
65.31%
G Data
NSIS.Application.Crypted, Win32.Application.Agent.RCEZAU
59.18%
Malwarebytes
PUP.Optional.Amonetize
57.14%
Kaspersky
not-a-virus:HEUR:AdWare.Win32.Amonetize
57.14%
Trend Micro House Call
Suspici.1CC0D1BF, TROJ_GEN.R047H07A615, TROJ_GEN.R08NH07LV14, TROJ_GE.28D9CDA2, TROJ_GEN.R047H07A315, TROJ_SPNR.08A015, TROJ_GEN.R0C1H07LV14
53.06%
Panda Antivirus
Generic Suspicious, Trj/CI.A, Trj/OCJ.F
46.94%
ESET NOD32
Win32/Amonetize.CW potentially unwanted application, Win32/Amonetize.CT potentially unwanted application
44.90%
Avira AntiVirus
Adware/Amonetize.307737, Adware/Amonetize.307740, Adware/AgentCV.A.119, ADWARE/AgentCV.A.119, Adware/Amonetize.307763, Adware/Amonetize.307635.1
38.78%
Baidu Antivirus
Adware.Win32.Amonetize, PUA.Win32.Amonetize
38.78%
Rising Antivirus
PE:Trojan.Win32.Generic.17E4A8DF!400861407, PE:AdWare.Win32.Adpeak.c!1075356117, PE:Trojan.Win32.Generic.17E18682!400656002
34.69%
The domain downprov2.dynadownload.com has been seen to resolve to the following 2 IP addresses.
File downloads found at URLs served by downprov2.dynadownload.com.
Latest 30 of 61 download URLs
URL:
http://downprov2.dynadownload.com/
SSL certificate subject:
CN=sni21209.cloudflaressl.com, OU=PositiveSSL Multi-Domain, OU=Domain Control Validated
SSL certificate issuer:
CN=COMODO ECC Domain Validation Secure Server CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
Web server:
cloudflare-nginx