home

hosting.zaonce.net

Frontier Developments PLC

Domain Information

The domain hosting.zaonce.net registered by Frontier Developments PLC was initially registered in November of 2013 through MESH DIGITAL LIMITED. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Ashburn, Virginia within the United States which resides on the Amazon.com, Inc. network. The domain uses the Amazon Cloudfront CDN service which utilizes a number of proxy IP Addresses (see below).
Registrar:
MESH DIGITAL LIMITED

Server location:
Virginia, United States (US)

Create date:
Tuesday, November 5, 2013

Expires date:
Monday, November 5, 2018

Updated date:
Thursday, November 7, 2013

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
zaonce.net

Whois:
1 zaonce.net record

Scanner detections:
Detections  (86% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.InstallCore (L)
96.88%

Bkav FE
HW32.Pedka
3.13%

The domain hosting.zaonce.net has been seen to resolve to the following 189 IP addresses.

52.84.125.133
server-52-84-125-133.iad16.r.cloudfront.net
July 11, 2016

52.84.125.104
server-52-84-125-104.iad16.r.cloudfront.net
July 11, 2016

52.84.125.5
server-52-84-125-5.iad16.r.cloudfront.net
July 11, 2016

52.84.125.207
server-52-84-125-207.iad16.r.cloudfront.net
July 11, 2016

52.84.125.147
server-52-84-125-147.iad16.r.cloudfront.net
July 11, 2016

52.84.125.146
server-52-84-125-146.iad16.r.cloudfront.net
July 11, 2016

52.84.125.140
server-52-84-125-140.iad16.r.cloudfront.net
July 11, 2016

52.84.125.139
server-52-84-125-139.iad16.r.cloudfront.net
July 11, 2016

52.84.125.62
server-52-84-125-62.iad16.r.cloudfront.net
July 1, 2016

52.84.125.48
server-52-84-125-48.iad16.r.cloudfront.net
July 1, 2016

52.84.125.252
server-52-84-125-252.iad16.r.cloudfront.net
July 1, 2016

52.84.125.219
server-52-84-125-219.iad16.r.cloudfront.net
July 1, 2016

52.84.125.184
server-52-84-125-184.iad16.r.cloudfront.net
July 1, 2016

52.84.125.165
server-52-84-125-165.iad16.r.cloudfront.net
July 1, 2016

52.84.125.123
server-52-84-125-123.iad16.r.cloudfront.net
July 1, 2016

52.84.125.84
server-52-84-125-84.iad16.r.cloudfront.net
July 1, 2016

52.85.142.26
server-52-85-142-26.iad12.r.cloudfront.net
June 5, 2016

52.85.142.164
server-52-85-142-164.iad12.r.cloudfront.net
June 5, 2016

52.85.142.135
server-52-85-142-135.iad12.r.cloudfront.net
June 5, 2016

52.85.142.124
server-52-85-142-124.iad12.r.cloudfront.net
June 5, 2016

52.85.142.108
server-52-85-142-108.iad12.r.cloudfront.net
June 5, 2016

52.85.142.93
server-52-85-142-93.iad12.r.cloudfront.net
June 5, 2016

52.85.142.77
server-52-85-142-77.iad12.r.cloudfront.net
June 5, 2016

52.85.142.56
server-52-85-142-56.iad12.r.cloudfront.net
June 5, 2016

52.85.131.182
server-52-85-131-182.iad53.r.cloudfront.net
May 22, 2016

52.85.131.167
server-52-85-131-167.iad53.r.cloudfront.net
May 22, 2016

52.85.131.143
server-52-85-131-143.iad53.r.cloudfront.net
May 22, 2016

52.85.131.27
server-52-85-131-27.iad53.r.cloudfront.net
May 22, 2016

52.85.131.231
server-52-85-131-231.iad53.r.cloudfront.net
May 22, 2016

52.85.142.79
server-52-85-142-79.iad12.r.cloudfront.net
May 20, 2016

 
Showing 30 of 189 IP Addresses

File downloads found at URLs served by hosting.zaonce.net.

1 / 68      (PUP)
http://hosting.zaonce.net/.../Client-Installer.exe  (4c322461359e74bf5e12310bc245ce27)

1 / 68      (PUP)
http://hosting.zaonce.net/.../Client-Installer-DX11.exe  (client-installer.exe)

1 / 68      (PUP)
http://hosting.zaonce.net/.../FrontierLaunchpadSetup-1.0.4.exe  (acad6d52c03e775b0536e15063d297a4)

1 / 68      (PUP)
http://hosting.zaonce.net/.../FrontierLaunchpadSetup-1.0.3.exe  (9daaadfa58defbcd35e73f96bbd282a5)

1 / 68      (PUP)
http://hosting.zaonce.net/.../FrontierLaunchpadSetup-1.0.2.exe  (d7d676376f4e356e3cf30d4f71e599ed)

The following 152 files have been seen to comunicate with hosting.zaonce.net in live environments.

TCP » 54.192.195.204:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 54.192.195.204:443
online-guardian-v2.0.9.exe

TCP » 54.192.195.231:443
online-guardian-v2.0.9.exe

TCP » 52.84.125.146:443
browserairexec.exe (BrowserAir by Goobzo)

TCP » 52.85.142.108:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.85.142.211:80
jingling.exe

TCP » 54.192.192.7:80
browser.exe (Browser)

TCP » 52.85.142.79:80
browser.exe (Browser)

TCP » 54.230.51.129:80
browser.exe (Browser)

TCP » 52.85.142.135:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 54.192.55.148:80
saber.exe

TCP » 52.85.142.245:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 54.192.55.166:80
binkiland.exe

TCP » 54.230.51.73:80
uncheckitupdate.exe (Uncheckit Module by EVANGEL TECHNOLOGY (HK) LIMITED)

TCP » 52.84.125.207:443
browserairexec.exe (BrowserAir by Goobzo)

TCP » 52.85.131.252:443
browser.exe (Browser)

TCP » 52.85.142.77:80
new_chrome.exe (1stBrowser by The 1stBrowser Authors)

TCP » 54.230.51.129:80
ipcdl.exe (YAC Security Protection by Elex do Brasil Participaçõesa)

TCP » 52.84.125.207:80
Client.exe

TCP » 54.192.55.148:80
saber.exe

 
Latest 20 of 285 files

URL:
http://hosting.zaonce.net/

Network:
Amazon Cloudfront

Web server:
AmazonS3

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.