home

gp387a.sazzip.com

Domains By Proxy, LLC  (Proxy Registrant)

Domain Information

The domain gp387a.sazzip.com is registered by proxy through GODADDY.COM, LLC and was originally registered in August of 2014. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Dulles, Virginia within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Cloudfront CDN service which utilizes a number of proxy IP Addresses (see below).
Registrar:
GODADDY.COM, LLC

Server location:
Virginia, United States (US)

Create date:
Friday, August 1, 2014

Expires date:
Monday, August 1, 2016

Updated date:
Sunday, August 2, 2015

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
sazzip.com

Whois:
1 sazzip.com record

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Installer.SmallIslandDevelopment.F, PUP.Installer.Injekt, PUP.Yontoo.Installer, PUP.Yontoo.IrrationalNumberApplications.Installer (M), PUP.Injekt.SmallIslandDevelopment.Installer (M), PUP.Yontoo.Irration.Installer (M)
90.00%

VIPRE Antivirus
Threat.4784449, Injekt, Threat.4872425
56.00%

Malwarebytes
PUP.Optional.TVWizard.A, PUP.Optional.MovieWizard.A, PUP.Optional.WebShield.A
52.00%

AVG
Smallis, Potentially harmful program Downloader.CBD, Generic_r, Adware Generic_r.YY
50.00%

Dr.Web
Threat.Undefined, Adware.Yontoo.55, Adware.Yontoo.57, Adware.Yontoo.59, Adware.Yontoo.79, Detection.Undefined
48.00%

K7 AntiVirus
Adware
46.00%

Baidu Antivirus
Adware.MSIL.PullUpdate, Adware.Win32.PullUpdate
42.00%

Avira AntiVirus
Adware/PullUpdate.AP, ADWARE/Adware.Gen7
38.00%

ESET NOD32
MSIL/Adware.PullUpdate
32.00%

Agnitum Outpost
PUA.PullUpdate
32.00%

Panda Antivirus
Adware/TVWizard, Generic Malware, PUP/WebShield, Trj/CI.A
30.00%

NANO AntiVirus
Riskware.Win32.PullUpdate.dmgkxa, Riskware.Win32.PullUpdate.dmgkwq, Riskware.Win32.PullUpdate.dmgkwr, Riskware.Win32.Yontoo.dqxulg
30.00%

Vba32 AntiVirus
TScope.Trojan.MSIL, AdWare.MSIL.PullUpdate, AdWare.SaMon
28.00%

ESET NOD32
multiple threats, MSIL/Adware.PullUpdate.A application
24.00%

Bitdefender
Application.Generic.951531, Application.Generic.947691, Application.Generic.947589, Application.Generic.1002757, Application.Generic.997827
24.00%

The domain gp387a.sazzip.com has been seen to resolve to the following 190 IP addresses.

52.84.125.109
server-52-84-125-109.iad16.r.cloudfront.net
August 29, 2016

52.84.125.98
server-52-84-125-98.iad16.r.cloudfront.net
August 29, 2016

52.84.125.93
server-52-84-125-93.iad16.r.cloudfront.net
August 29, 2016

52.84.125.15
server-52-84-125-15.iad16.r.cloudfront.net
August 29, 2016

52.84.125.246
server-52-84-125-246.iad16.r.cloudfront.net
August 29, 2016

52.84.125.231
server-52-84-125-231.iad16.r.cloudfront.net
August 29, 2016

52.84.125.140
server-52-84-125-140.iad16.r.cloudfront.net
August 29, 2016

52.85.131.89
server-52-85-131-89.iad53.r.cloudfront.net
July 21, 2016

52.85.131.198
server-52-85-131-198.iad53.r.cloudfront.net
July 21, 2016

52.84.125.208
server-52-84-125-208.iad16.r.cloudfront.net
July 19, 2016

52.84.125.202
server-52-84-125-202.iad16.r.cloudfront.net
July 19, 2016

52.84.125.127
server-52-84-125-127.iad16.r.cloudfront.net
July 19, 2016

52.84.125.81
server-52-84-125-81.iad16.r.cloudfront.net
July 19, 2016

52.84.125.53
server-52-84-125-53.iad16.r.cloudfront.net
July 19, 2016

52.84.125.5
server-52-84-125-5.iad16.r.cloudfront.net
July 19, 2016

52.84.125.254
server-52-84-125-254.iad16.r.cloudfront.net
July 19, 2016

52.84.125.230
server-52-84-125-230.iad16.r.cloudfront.net
July 19, 2016

52.85.131.239
server-52-85-131-239.iad53.r.cloudfront.net
July 18, 2016

52.85.131.238
server-52-85-131-238.iad53.r.cloudfront.net
July 18, 2016

52.85.131.213
server-52-85-131-213.iad53.r.cloudfront.net
July 18, 2016

52.85.131.180
server-52-85-131-180.iad53.r.cloudfront.net
July 18, 2016

52.85.131.110
server-52-85-131-110.iad53.r.cloudfront.net
July 18, 2016

52.85.131.60
server-52-85-131-60.iad53.r.cloudfront.net
July 18, 2016

52.85.131.22
server-52-85-131-22.iad53.r.cloudfront.net
July 18, 2016

52.85.131.36
server-52-85-131-36.iad53.r.cloudfront.net
July 3, 2016

52.85.131.30
server-52-85-131-30.iad53.r.cloudfront.net
July 3, 2016

52.85.131.19
server-52-85-131-19.iad53.r.cloudfront.net
July 3, 2016

52.85.131.179
server-52-85-131-179.iad53.r.cloudfront.net
July 3, 2016

52.85.131.174
server-52-85-131-174.iad53.r.cloudfront.net
July 3, 2016

52.85.131.107
server-52-85-131-107.iad53.r.cloudfront.net
July 3, 2016

 
Showing 30 of 190 IP Addresses

File downloads found at URLs served by gp387a.sazzip.com.

16 / 68    (Adware)
http://gp387a.sazzip.com/mw/.../Setup.exe  (df2592637a571e9ac9f3b6d7d77d07ea)

1 / 68      (Adware)
http://gp387a.sazzip.com/ws/.../Setup.exe  (e7510ab29f2bb046a0fb773171f5e175)

25 / 68    (Adware)
http://gp387a.sazzip.com/tw/.../Setup.exe  (b41ddc192c550fb7f35bcace5dcb4adb)

4 / 68      (Adware)
http://gp387a.sazzip.com/tw/.../Setup.exe  (ce05175c0a0d64aa7de1426c3de856b7)

1 / 68      (Adware)
http://gp387a.sazzip.com/ws/.../Setup.exe  (86e37db7806e910135d81e243f2d92da)

21 / 68    (Adware)
http://gp387a.sazzip.com/tw/.../Setup.exe  (aadbc8dab4e377099fc495094f08dbab)

23 / 68    (Adware)
http://gp387a.sazzip.com/mw/.../Setup.exe  (4e623cc3da811f77365548d993575007)

23 / 68    (Adware)
http://gp387a.sazzip.com/mw/.../Setup.exe  (0ef1511f79fedab6a865ed3086805c90)

24 / 68    (Adware)
http://gp387a.sazzip.com/tw/.../Setup.exe  (beeaebffdcb2c73c47628ab01f0655a7)

21 / 68    (Adware)
http://gp387a.sazzip.com/mw/.../Setup.exe  (724391a60f5d04f48839cacd44715d48)

19 / 68    (Adware)
http://gp387a.sazzip.com/mw/.../Setup.exe  (e7ae456eb3e82319ca6712c00c53bd22)

14 / 68    (Adware)
http://gp387a.sazzip.com/tw/.../Setup.exe  (9920bad6900893686c44ff281b7ddd95)

The following 186 files have been seen to comunicate with gp387a.sazzip.com in live environments.

TCP » 52.85.142.218:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.85.142.132:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 54.192.19.167:80
browser.exe (Browser)

TCP » 54.192.19.155:80
saber.exe

TCP » 52.85.142.55:80
browser.exe (Browser)

TCP » 54.192.19.155:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 54.192.19.33:80
saber.exe

TCP » 54.192.19.36:80
browser.exe (Browser)

TCP » 54.192.19.167:80
uvconverter.exe

TCP » 52.85.131.71:443
instatime.exe

TCP » 54.192.19.167:80
uvconverter.exe

TCP » 54.192.19.155:80
uvconverter.exe

TCP » 54.192.19.36:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.85.142.218:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.85.131.30:443
browser.exe (Browser)

TCP » 52.85.142.90:443
UCBrowser.exe (by UCWeb)

TCP » 54.192.19.209:443
browserairexec.exe (BrowserAir by Goobzo)

TCP » 54.192.19.155:80
winsaber.exe

TCP » 54.192.19.18:80
uvconverter.exe

TCP » 52.84.125.239:80
citrio.exe (Citrio by CatalinaGroup)

 
Latest 20 of 394 files

URL:
http://gp387a.sazzip.com/

Network:
Amazon Cloudfront

Web server:
AmazonS3

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.