home

install.betweenlinesnow.com

Domain Information

Server location:
Mazowieckie, Poland (PL)

ASN:
AS20940 AKAMAI-ASN1 Akamai International B.V., US

Root domain:
betweenlinesnow.com

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Yontoo.ZipPath.Installer (M), PUP.Yontoo.BetweenL.Installer (M)
100.00%

The domain install.betweenlinesnow.com has been seen to resolve to the following 3 IP addresses.

104.96.220.177
a104-96-220-177.deploy.static.akamaitechnologies.com
August 2, 2016

104.96.220.105
a104-96-220-105.deploy.static.akamaitechnologies.com
August 2, 2016

8.34.112.137
April 21, 2016

File downloads found at URLs served by install.betweenlinesnow.com.

1 / 68      (Adware)
http://install.betweenlinesnow.com/ud  (betweenlinesuninstaller.exe)

1 / 68      (PUP)
http://install.betweenlinesnow.com/ud  (betweenlinesuninstaller.exe)

The following 13 files have been seen to comunicate with install.betweenlinesnow.com in live environments.

TCP » 104.96.220.105:80
kometa.exe (Kometa by Kometa Authors)

TCP » 104.96.220.177:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 104.96.220.105:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 104.96.220.105:443
new_chrome.exe (1stBrowser by The 1stBrowser Authors)

TCP » 104.96.220.105:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 104.96.220.105:443
kometa.exe (Kometa by Kometa Authors)

TCP » 104.96.220.105:80
hhilmhncbjigfhmipgedaindfhhgfngg.crx

TCP » 104.96.220.105:80
hhilmhncbjigfhmipgedaindfhhgfngg.crx

TCP » 104.96.220.105:80
djcjdcmddadenpdjpddckpdjiddepbhm.crx

TCP » 104.96.220.105:80
hhilmhncbjigfhmipgedaindfhhgfngg.crx

TCP » 104.96.220.177:80
ejhblhjjbjfgohafhpdacldpmmcmmjlc.crx

TCP » 104.96.220.177:80
kneljoemmoafkcofmnbajlkmgbpimfkg.crx

TCP » 104.96.220.177:80
cfpgcdlmnkebcilijcbnpmgobkpkknak.crx

TCP » 104.96.220.177:80
mgecpdghpgpnpbaipkgdmjmoihnhicjg.crx

TCP » 104.96.220.177:80
ejhblhjjbjfgohafhpdacldpmmcmmjlc.crx

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.