home

dsu7x9k8c43un.cloudfront.net

Amazon.com, Inc

Domain Information

The domain dsu7x9k8c43un.cloudfront.net registered by Amazon.com, Inc was initially registered in April of 2008 through MARKMONITOR INC.. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Dulles, Virginia within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Cloudfront CDN service which utilizes a number of proxy IP Addresses (see below).
Registrar:
MARKMONITOR INC.

Server location:
Virginia, United States (US)

Create date:
Friday, April 25, 2008

Expires date:
Tuesday, April 25, 2017

Updated date:
Tuesday, February 25, 2014

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
cloudfront.net

Whois:
1 cloudfront.net record

Scanner detections:
Detections  (68% detected)

Scan engine
Details
Detections

Reason Heuristics
(M), PUP.AVSoftwareEOOD.Z, PUP.AVSoftwareEOOD.J, PUP.AVSoftwareEOOD.H, PUP.AVSoftwareEOOD.K, PUP.AVSoftwareEOOD.P, PUP.AVSoftwareEOOD.T, PUP.AVSoftwareEOOD.M, PUP.Softpulse.Sambamed.Bundler (M), PUP.InstallCore.RE11 (M)
85.00%

Malwarebytes
PUP.Optional.SoftM8.A
65.00%

Trend Micro House Call
TROJ_GEN.F47V0205, HV_ZYX_CA082E56.TOMC, Suspicious_GEN.F47V0910
15.00%

Qihoo 360 Security
Malware.QVM11.Gen, HEUR/Malware.QVM11.Gen, HEUR/QVM11.1.Malware.Gen
15.00%

Avira AntiVirus
W32/Mabezat, ADWARE/InstallCore.Gen7
10.00%

Sophos
Install Core Click run software, Install Core Click run software (PUA)
10.00%

K7 AntiVirus
Unwanted-Program , Riskware
10.00%

AVG
Generic
10.00%

Microsoft Security Essentials
Worm:Win32/NeksMiner.A
5.00%

F-Secure
Application:W32/Generic.70053c248f!Online
5.00%

Clam AntiVirus
Win.Malware.Agent3850084642/CRDF-1
5.00%

Rising Antivirus
PE:Malware.XPACK/RDM!5.1
5.00%

herdProtect (fuzzy)
a variant of ee1b9ea727dde1c588e15a051a71313c856bc815
5.00%

McAfee
Artemis!294B58A16B44
5.00%

Norman
InstallCore.WQEB
5.00%

The domain dsu7x9k8c43un.cloudfront.net has been seen to resolve to the following 148 IP addresses.

52.84.125.201
server-52-84-125-201.iad16.r.cloudfront.net
August 22, 2016

52.84.125.178
server-52-84-125-178.iad16.r.cloudfront.net
August 22, 2016

52.84.125.128
server-52-84-125-128.iad16.r.cloudfront.net
August 22, 2016

52.84.125.99
server-52-84-125-99.iad16.r.cloudfront.net
August 22, 2016

52.84.125.94
server-52-84-125-94.iad16.r.cloudfront.net
August 22, 2016

52.84.125.25
server-52-84-125-25.iad16.r.cloudfront.net
August 22, 2016

52.84.125.21
server-52-84-125-21.iad16.r.cloudfront.net
August 22, 2016

52.84.125.213
server-52-84-125-213.iad16.r.cloudfront.net
August 22, 2016

52.85.131.202
server-52-85-131-202.iad53.r.cloudfront.net
July 23, 2016

52.85.131.141
server-52-85-131-141.iad53.r.cloudfront.net
July 23, 2016

52.85.131.111
server-52-85-131-111.iad53.r.cloudfront.net
July 23, 2016

52.85.131.107
server-52-85-131-107.iad53.r.cloudfront.net
July 23, 2016

52.85.131.37
server-52-85-131-37.iad53.r.cloudfront.net
July 23, 2016

52.85.131.252
server-52-85-131-252.iad53.r.cloudfront.net
July 23, 2016

52.85.131.244
server-52-85-131-244.iad53.r.cloudfront.net
July 23, 2016

52.85.131.239
server-52-85-131-239.iad53.r.cloudfront.net
July 23, 2016

52.85.142.27
server-52-85-142-27.iad12.r.cloudfront.net
June 18, 2016

52.85.142.152
server-52-85-142-152.iad12.r.cloudfront.net
June 18, 2016

52.85.142.150
server-52-85-142-150.iad12.r.cloudfront.net
June 18, 2016

52.85.142.131
server-52-85-142-131.iad12.r.cloudfront.net
June 18, 2016

52.85.142.122
server-52-85-142-122.iad12.r.cloudfront.net
June 18, 2016

52.85.142.96
server-52-85-142-96.iad12.r.cloudfront.net
June 18, 2016

52.85.142.84
server-52-85-142-84.iad12.r.cloudfront.net
June 18, 2016

52.85.131.172
server-52-85-131-172.iad53.r.cloudfront.net
May 26, 2016

52.85.131.114
server-52-85-131-114.iad53.r.cloudfront.net
May 20, 2016

52.85.131.110
server-52-85-131-110.iad53.r.cloudfront.net
May 20, 2016

52.85.131.70
server-52-85-131-70.iad53.r.cloudfront.net
May 20, 2016

52.85.131.39
server-52-85-131-39.iad53.r.cloudfront.net
May 20, 2016

52.85.131.191
server-52-85-131-191.iad53.r.cloudfront.net
May 20, 2016

52.85.131.178
server-52-85-131-178.iad53.r.cloudfront.net
May 20, 2016

 
Showing 30 of 148 IP Addresses

File downloads found at URLs served by dsu7x9k8c43un.cloudfront.net.

0 / 68
https://dsu7x9k8c43un.cloudfront.net/minecraft.exe  (MinecraftLauncher.exe)

2 / 68      (Adware)
https://dsu7x9k8c43un.cloudfront.net/spotify.exe  (..exe)

1 / 68      (PUP)
https://dsu7x9k8c43un.cloudfront.net/minecraft.exe  (c8c2aacfb60f9b628891f7a20acaa8e3)

2 / 68      (false positives)
https://dsu7x9k8c43un.cloudfront.net/minecraft.exe  (wrar420.exe)

11 / 68    (Adware)
https://dsu7x9k8c43un.cloudfront.net/minecraft.exe  (294b58a16b44af75eb4e083a92223f6c)

1 / 68      (Adware)
https://dsu7x9k8c43un.cloudfront.net/minecraft.exe  (b842a1b18801c28372891a121f030234)

0 / 68
https://dsu7x9k8c43un.cloudfront.net/spotify.exe  (spotifysetup.exe)

3 / 68      (Adware)
https://dsu7x9k8c43un.cloudfront.net/free-download-manager.exe  (625a2acb4d99d0697f31b20a9b761b09)

2 / 68      (Malware)
https://dsu7x9k8c43un.cloudfront.net/minecraft.exe  (3c166bae84553d4cb27af8abdc61712d)

5 / 68      (Adware)
https://dsu7x9k8c43un.cloudfront.net/viber-for-windows-pc.exe  (708a9a2390c076a3fe3fa8d67aba5411)

0 / 68
https://dsu7x9k8c43un.cloudfront.net/minecraft.exe  (MinecraftLauncher.exe)

0 / 68
https://dsu7x9k8c43un.cloudfront.net/vlc-player.exe  (1acd2852b3b1161831e40f22b23b2f00)

4 / 68      (Adware)
https://dsu7x9k8c43un.cloudfront.net/spotify.exe  (b3df207b302279739fd558531cbec9bd)

2 / 68      (Adware)
https://dsu7x9k8c43un.cloudfront.net/counter-strike.exe  (w2+sb+o_.exe)

2 / 68      (Adware)
https://dsu7x9k8c43un.cloudfront.net/kaspersky-free-2015.exe  (12cfb86482ca8550c42477fdf4c5128d)

1 / 68
https://dsu7x9k8c43un.cloudfront.net/minecraft.exe  (b63ccb43f2779cbea5d8d3ce2e3d90fb)

3 / 68      (Adware)
https://dsu7x9k8c43un.cloudfront.net/yahoo-messenger.exe  (549b67e5db1b22298041110d3a12d820)

2 / 68      (Adware)
https://dsu7x9k8c43un.cloudfront.net/kaspersky-free-2015.exe  (967fa6fb2558f74fe67b8f7d8d0e3e04)

5 / 68      (Adware)
https://dsu7x9k8c43un.cloudfront.net/minecraft.exe  (efbcdf30daa8c436b0e9362c91a9d9ec)

0 / 68
https://dsu7x9k8c43un.cloudfront.net/vlc-player.exe  (5aad9a4b2a2d30afb70bb214ea5091ad)

2 / 68      (Adware)
https://dsu7x9k8c43un.cloudfront.net/vlc-player.exe  (7537697a2bd2d8cb620e78267a48655e)

2 / 68      (Adware)
https://dsu7x9k8c43un.cloudfront.net/spotify.exe  (9973179c6dcf185e8cc7cc2b46b1d9d8)

2 / 68      (Adware)
https://dsu7x9k8c43un.cloudfront.net/avast-free-antivirus-2014.exe  (ba786de12b83d3ee1026c293db7267cb)

2 / 68      (Adware)
https://dsu7x9k8c43un.cloudfront.net/minecraft.exe  (7d263f6ffed4bc9ec5498045f56d337b)

1 / 68
https://dsu7x9k8c43un.cloudfront.net/minecraft.exe  (minecraft_server.1.7.2.exe)

The following 87 files have been seen to comunicate with dsu7x9k8c43un.cloudfront.net in live environments.

TCP » 52.85.142.35:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.85.142.6:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.85.142.108:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.85.142.217:80
se.exe

TCP » 52.84.125.94:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.85.142.7:443
whatsapptime.exe

TCP » 54.230.37.34:80
citrio.exe (Citrio by CatalinaGroup)

TCP » 52.85.142.194:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.85.142.80:80
beamrise.exe (Beamrise by The Beamrise Authors)

TCP » 52.85.142.194:443
messengertime.exe

TCP » 52.85.142.253:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.85.142.253:443
clearscreenplayerbrowser.exe

TCP » 52.85.142.253:80
browser.exe (Browser)

TCP » 52.85.142.144:443
jingling.exe

TCP » 52.84.125.25:80
crossbrowse.exe (Crossbrowse)

TCP » 52.85.131.252:443
browser.exe (Browser)

TCP » 54.192.192.27:443
apptrailers.exe

TCP » 52.85.142.147:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.85.142.253:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.85.142.108:443
UCBrowser.exe (UC Browser by UCWeb)

 
Latest 20 of 227 files

URL:
http://dsu7x9k8c43un.cloudfront.net/

Network:
Amazon Cloudfront

SSL certificate subject:
CN=*.cloudfront.net, O="Amazon.com, Inc.", L=Seattle, S=Washington, C=US

SSL certificate issuer:
CN=Symantec Class 3 Secure Server CA - G4, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Web server:
AmazonS3

Compete.com:
US visitors:  6,678

Statistics are for the previous month.

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.