home

nym1.b.adnxs.com

AppNexus Inc

Domain Information

The domain nym1.b.adnxs.com registered by AppNexus Inc was initially registered in May of 2008 through MARKMONITOR INC.. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Corona del Mar, California within the United States which resides on the AppNexus, Inc network.
Registrar:
MARKMONITOR INC.

Server location:
California, United States (US)

Create date:
Tuesday, May 27, 2008

Expires date:
Friday, May 27, 2016

Updated date:
Saturday, April 26, 2014

ASN:
AS29990 ASN-APPNEXUS - AppNexus, Inc,US

Root domain:
adnxs.com

Whois:
1 adnxs.com record

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Installer.Stepitapp.F, PUP.Installer.BuildInput.U, PUP.Adknowledge.WARPINSTALLER.Installer (M), PUP.Adknowledge.Liquidbuild.Installer (M), PUP.Solimba.Bechiro.Bundler (M), PUP.Adknowledge.Liquidbuild.Bundler (M), PUP.Air Software.AirSoftw.Bundler (M), PUP.Adknowledge.BuildInp.Bundler (M), PUP.Adknowledge.BootComp.Installer (M)
100.00%

McAfee
Artemis!8A2ED863690C, Trojan.Artemis!2BDA97A3EE62, GenericATG-FGI!9BBCEAD72578, Artemis!0FF2B0F7AD04
41.67%

Kaspersky
not-a-virus:Downloader.Win32.Agent, not-a-virus:AdWare.Win32.iBryte
41.67%

VIPRE Antivirus
Conduit, Threat.4778314, Threat.4150696
41.67%

Vba32 AntiVirus
Downloader.Agent, AdWare.iBryte
41.67%

Panda Antivirus
Trj/Chgt.A, Trj/Genetic.gen
41.67%

Fortinet FortiGate
Riskware/Agent, W32/Zbot.AAN!tr, Riskware/Generic.AC.1188117, W32/Malware_fam.NB
41.67%

Qihoo 360 Security
HEUR/Malware.QVM03.Gen, Malware.QVM10.Gen, Win32/Trojan.Dropper.c9f
41.67%

avast!
Win32:Dropper-gen [Drp], Win32:Adware-gen [Adw], Win32:IBryte-CX [PUP]
41.67%

Trend Micro House Call
Suspicious_GEN.F47V0620, TROJ_CLIKUG.A
33.33%

Malwarebytes
PUP.Optional.OptimumInstaller.A, PUP.Optional.GigaClicks.A
33.33%

Agnitum Outpost
PUA.Agent, Riskware.Agent
33.33%

Sophos
iBryte Optimum Installer, PUA.iBryte Optimum Installer
33.33%

Dr.Web
Trojan.DownLoader11.30378, Trojan.Packed.26508, Trojan.DownLoader11.32275
33.33%

Avira AntiVirus
ADWARE/Adware.Gen7, TR/Kazy.439479.2
33.33%

The domain nym1.b.adnxs.com has been seen to resolve to the following 3 IP addresses.

68.67.153.38
September 7, 2014

68.67.153.35
float.1867.bm-impbus.prod.nym2.adnexus.net
September 7, 2014

68.67.153.39
float.1866.bm-impbus.prod.nym2.adnexus.net
September 7, 2014

File downloads found at URLs served by nym1.b.adnxs.com.

1 / 68      (Adware)
http://nym1.b.adnxs.com/click?sD3ksmKg8D-amZmZmZnrPxygVp0dltQ_Bk_QGKPDAEBC87CopTIEQF_njFAkXVdGbpjhG3gxOF-1RhpUAAAAAB_OMgCTBwAAdgIAAAIAAACrTCcBhWwHAAAAAQBVU0QAVVNEACwB-gDOcAAAYrAAAgUAAQIAAJQAmSUZTwAAAAA./cnd=!mgULNAiug7ECEKuZnQkYhdkdIAA./referrer=http://landing.driverrestore.com/4101/02/en/?custom2=f0cdcf89b0674fb4a8967455e660d6fe/clickenc=http://download131bucket.com/.../flashplayerpro?source=marimedia_lightspark-us-ddl-cpa&creative_id=player &adprovider=marimedia&ce_cid=nym1CO6wht-Br4ycXxACGN_Os4TFpNerRiINMTYyLjIzNi4yMzQuNSgBMLWN6aAF  (flashplayerpro_setup.exe)

1 / 68      (Adware)
http://nym1.b.adnxs.com/click?vJHCxzMHzT_yMJ2HLn_GP8uhRbbz_eQ_8jCdhy5_xj-8kcLHMwfNP98uWROLSkJHZpG3Iyce-BhxWfZTAAAAAN-QMgDaBgAAdgIAAAIAAAANUAEB6jIGAAAAAQBVU0QAVVNEANgCWgCgfAAAbKcAAgUAAQIAAJQACSi8NgAAAAA./cnd=!IQaSOAim5aICEI2ghQgY6uUYIAA./referrer=feedback.ebay.com/clickenc=http://download131bucket.com/.../flashplayerpro?source=marimedia_lightspark-us-ddl-cpa&creative_id=player &adprovider=marimedia&ce_cid=nym1COai3p3yxIf8GBACGN_d5Jqx0ZKhRyIOMjQuMTI3LjEyNi4xOTEoATDxstmfBQ..  (flashplayerpro_setup.exe)

1 / 68      (Adware)
http://nym1.b.adnxs.com/click?yuAoeXWO7T_K4Ch5dY7tP1K4HoXrUfA_yuAoeXWO7T_K4Ch5dY7tPzSqtsH9V_4tHYUbkf3-NGD-UPFSAAAAAHLJIAB2AgAAdgIAAAIAAADyKbMAdvEEAAAAAQBVU0QAVVNEAFABGAGBMQAAzaYAAgQCAQIAAIwAyCvmZQAAAAA./cnd=!aQdeRgj866sBEPLTzAUY9uITIAQ./referrer=http://adsdelivery1.com/ads?v=1&key=91e6315520fa3935d8af4d611e732771&ch=72&click=&tz=-5&t=1391546621541&cp.str1=com&cp.str2=printablecouponcode&cp.str3=undefined&cp.str4=undefined&cp.host=printablecouponcode.com&scrWidth=1366&scrHeight=768/clickenc=http://adsdelivery1.com/cr?b=457&p=183&ch=72&cps=&c=63&l=US&h=20e7ae2be1e8fe0a2594268d497b6ac1&t=1391546621764&u=http://.../?a=200518&oc=2760&c=23210&s2=nym1CJ2K7ojZ37-aYBACGLTU2o3c_5X_LSIOMTg0LjU3LjExMy4xNzMoATD-ocWXBQ..&subid=2148722  (download_manager.exe)

40 / 68    (Adware)
http://nym1.b.adnxs.com/click?cB_BfQT3sT-4HoXrUbiuP7gehetRuK4_5t_Eyn_3sD-3U8WyHdizP8BK_1AdT9wsx9lGa9u3bFzkJENUAAAAAKkeKwBfAAAAdgIAAAIAAACjTCcBeT8GAAAAAQBVU0QAVVNEACwB-gBnXQAABbUAAgUAAQIAAJIAIim9wQAAAAA./cnd=!kQZOPAiw2sMCEKOZnQkY-f4YIAA./referrer=http://ib.adnxs.com/tt?id=2825897&size=300x250&referrer=${REFERER_URL}&1Q4NR54x=116_18x18_0/clickenc=http://fabulous-wealth2d3fd5.com/.../serve?c=marimedia&s=marimedia_lightspark-us-ddl-cpa&ce_cid=nym1CMezm9q2-622XBACGMCV_YfV45PuLCILMjQuNDkuNDUuMTkoATDkyYyiBQ..  (flashplayerpro_setup.exe)

1 / 68      (Adware)
http://nym1.b.adnxs.com/click?h9FFedW_0D-H0UV51b_QPx1aZDvfT80_h9FFedW_0D-H0UV51b_QP-Gx3B64-1hBnunAUi7cjAgtQoFTAAAAAKaYIAB2AgAAdgIAAAIAAADW0uwAUGYFAAAAAQBVU0QAVVNEACwB-gB7OwAA1K8AAgQAAQIAAIwA9CvJWAAAAAA./cnd=!sQb1Pwjio_EBENalswcY0MwVIAM./referrer=http://cdn.sharedaddomain.com/slider_anchored_300x250_284.htm?cat=107,312&clientId=178a4f9b-5074-49b4-8d7f-17bf4e830ca6&l=http://historiacsd.blogspot.com.br/2012/04/segunda-guerra-mundial-questoes-de.html&r=http://historiacsd.blogspot.com.br/2013/12/questoes-de-vestibulares-simulados.html/clickenc=http://2.track342ut.com/d/.../nym1CJ7Tg5blhbfGCBACGOHj8vaB976sQSIOMTg3LjEyNy40OC4yNTAoATCthIWcBQ..  (setup.exe)

1 / 68      (Adware)
http://nym1.b.adnxs.com/click?h9FFedW_0D-H0UV51b_QPx1aZDvfT80_h9FFedW_0D-H0UV51b_QP-Gx3B64-1hBnunAUi7cjAgtQoFTAAAAAKaYIAB2AgAAdgIAAAIAAADW0uwAUGYFAAAAAQBVU0QAVVNEACwB-gB7OwAA1K8AAgQAAQIAAIwA9CvJWAAAAAA./cnd=!sQb1Pwjio_EBENalswcY0MwVIAM./referrer=http://cdn.sharedaddomain.com/slider_anchored_300x250_284.htm?cat=107,312&clientId=178a4f9b-5074-49b4-8d7f-17bf4e830ca6&l=http://historiacsd.blogspot.com.br/2012/04/segunda-guerra-mundial-questoes-de.html&r=http://historiacsd.blogspot.com.br/2013/12/questoes-de-vestibulares-simulados.html/clickenc=http://2.track342ut.com/d/.../nym1CJ7Tg5blhbfGCBACGOHj8vaB976sQSIOMTg3LjEyNy40OC4yNTAoATCthIWcBQ..  (setup.exe)

1 / 68      (Adware)
http://nym1.b.adnxs.com/click?h9FFedW_0D-H0UV51b_QPx1aZDvfT80_h9FFedW_0D-H0UV51b_QP-Gx3B64-1hBnunAUi7cjAgtQoFTAAAAAKaYIAB2AgAAdgIAAAIAAADW0uwAUGYFAAAAAQBVU0QAVVNEACwB-gB7OwAA1K8AAgQAAQIAAIwA9CvJWAAAAAA./cnd=!sQb1Pwjio_EBENalswcY0MwVIAM./referrer=http://cdn.sharedaddomain.com/slider_anchored_300x250_284.htm?cat=107,312&clientId=178a4f9b-5074-49b4-8d7f-17bf4e830ca6&l=http://historiacsd.blogspot.com.br/2012/04/segunda-guerra-mundial-questoes-de.html&r=http://historiacsd.blogspot.com.br/2013/12/questoes-de-vestibulares-simulados.html/clickenc=http://2.track342ut.com/d/.../nym1CJ7Tg5blhbfGCBACGOHj8vaB976sQSIOMTg3LjEyNy40OC4yNTAoATCthIWcBQ..  (setup.exe)

1 / 68      (Adware)
http://nym1.b.adnxs.com/click?h9FFedW_0D-H0UV51b_QPx1aZDvfT80_h9FFedW_0D-H0UV51b_QP-Gx3B64-1hBnunAUi7cjAgtQoFTAAAAAKaYIAB2AgAAdgIAAAIAAADW0uwAUGYFAAAAAQBVU0QAVVNEACwB-gB7OwAA1K8AAgQAAQIAAIwA9CvJWAAAAAA./cnd=!sQb1Pwjio_EBENalswcY0MwVIAM./referrer=http://cdn.sharedaddomain.com/slider_anchored_300x250_284.htm?cat=107,312&clientId=178a4f9b-5074-49b4-8d7f-17bf4e830ca6&l=http://historiacsd.blogspot.com.br/2012/04/segunda-guerra-mundial-questoes-de.html&r=http://historiacsd.blogspot.com.br/2013/12/questoes-de-vestibulares-simulados.html/clickenc=http://2.track342ut.com/d/.../nym1CJ7Tg5blhbfGCBACGOHj8vaB976sQSIOMTg3LjEyNy40OC4yNTAoATCthIWcBQ..  (setup.exe)

40 / 68    (Adware)
http://nym1.b.adnxs.com/click?l9QSNZrFsz9QlkPSe6WuPwAAAAAAAPA_UJZD0nulrj-X1BI1msWzP2SMFQGkaD0IvQS7tQDJ8xImrz5UAAAAACMBNwByBwAAdgIAAAIAAADH9ikBEq8HAAAAAQBVU0QAVVNEANgCWgDZDAAAwrAAAgUAAQIAAJYABCNSCgAAAAA./cnd=!egYvPQij3rMCEMftpwkYkt4eIAE./referrer=nym1.b.adnxs.com/clickenc=http://fabulous-wealth2d3fd5.com/.../serve?c=marimedia&s=marimedia_lightspark-us-ddl-cpa&ce_cid=nym1CL2J7K2LoPL5EhACGOSY1ojAlNqeCCILNzEuOC41OS4xMDUoATCm3vqhBQ..  (flashplayerpro_setup.exe)

36 / 68    (Adware)
http://nym1.b.adnxs.com/click?xve2c-h_xD_azI7mQca_Py_dJAaBlec_2syO5kHGvz_H97Zz6H_EPwbOh6D83aVhSO_UPHnQ_ks40npTAAAAAFwPKQAyAwAAdgIAAAIAAABicdQAwvUFAAAAAQBVU0QAVVNEANQBPAB0FAAA0aQAAQUAAQIAAJAAAi6RUgAAAAA./cnd=!Gge7QgiS8-QBEOLi0QYYwusXIAA./referrer=http://www.efix.com/lp/sys/?tracking=say/clickenc=http://nym1.b.adnxs.com/click?O99PjZdugj9Px2MGKuN_PwAAAAAAAPA_T8djBirjfz8730-Nl26CP05RWMco46pBSO_UPHnQ_ks30npTAAAAAOHtKADLBgAAMgMAAAIAAADQwd8AusoFAAAAAQBVU0QAVVNEANQBPABBLwAABdUAAQUAAQIAAJAAYyVMiQAAAAA./cnd=!-QWWNwiGgeIBENCD_wYYupUXIAA./referrer=http://www.efix.com/lp/sys/?tracking=say&banner=direct&adgroup=direct&ads_name=direct&keyword=direct&CID=269852&ClickID=05_128408965_34e39dec-2b20-4619-8a47-464aa47ccfa0/clickenc=http://downloadsinstant.com/.../flashplayerpro?source=marimedia_lightspark-us-ddl-cpa&creative_id=player &adprovider=marimedia&ce_cid=nym1CMje0-aTj7T_SxACGIacn4TKv_fSYSINNjcuMjQ5LjkxLjIwNCgBMLik65sF  (flashplayerpro_setup.exe)

39 / 68    (Adware)
http://nym1.b.adnxs.com/click?0id90id90j8EVg4tsp3PPwRWDi2ync8_eE-Dy0FW4D_kd9JWhxvjP53c2t584cY6fgCBKOmI_SYygP9TAAAAAFUFHwBfAAAAdgIAAAIAAACNqhoBXRIFAAAAAQBVU0QAVVNEACwB-gA9GAAAEqgAAgUAAQIAAJIABCUGJwAAAAA./cnd=!fQZdPQiz3rACEI3V6ggY3aQUIAA./referrer=www.tenga-global.com/clickenc=http://download131bucket.com/.../flashplayerpro?source=marimedia_lightspark-us-ddl-cpa&creative_id=player &adprovider=marimedia&ce_cid=nym1CP6AhMSSneL-JhACGJ256_bNr7jjOiIMMjQuMjkuNzIuMjIzKAEwsoD-nwU.  (flashplayerpro_setup.exe)

10 / 68    (Adware)
http://nym1.b.adnxs.com/click?MzMzMzMz4z-rHFpkO9_fPzMzMzMzMwNAqxxaZDvf3z8zMzMzMzPjP-42RRXBycwGguPY26u1_TQrwrVTAAAAAA3pKQCTBwAAdgIAAAIAAABA7_UA4n0GAAAAAQBVU0QAVVNEACwB-gDztAAAltUAAgUAAQIAAJAAeCXyCQAAAAA./cnd=!EweyQQj01IYCEMDe1wcY4vsZIAA./referrer=http://www.solitairetime.com/?chromestore=1/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CILH4969te3-NBACGO7tlKqRuLLmBiINNzQuMTA5LjIxOS41MigBMKuE150F&tag=2746637  (setup.exe)

The following 4 files have been seen to comunicate with nym1.b.adnxs.com in live environments.

TCP » 68.67.153.35:80
cmd.exe

TCP » 68.67.153.38:80
OfferBoulevardW.exe (PennyBee)

TCP » 68.67.153.38:80
duuvri.exe (Maskiseft Visual Studio 2010 by Maskiseft)

TCP » 68.67.153.38:80
roxyir.exe (by Nobemame Corporatu)

URL:
http://nym1.b.adnxs.com/

Google Analytics:
UA-4057742

Title:
“error page for redirects from product”

Web server:
Apache/2.2.22 (Ubuntu)

aim4media.com

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.