home

nym2.ib.adnxs.com

AppNexus Inc

Domain Information

The domain nym2.ib.adnxs.com registered by AppNexus Inc was initially registered in May of 2008 through MARKMONITOR INC.. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Santa Monica, California within the United States which resides on the AppNexus, Inc network.
Registrar:
MARKMONITOR INC.

Server location:
California, United States (US)

Create date:
Tuesday, May 27, 2008

Expires date:
Friday, May 27, 2016

Updated date:
Saturday, April 26, 2014

ASN:
AS29990 ASN-APPNEXUS - AppNexus, Inc,US

Root domain:
adnxs.com

Whois:
2 adnxs.com records

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Installer.PaymentsInteractiveSL.M, PUP.Softpulse.SoftpulseSl.Bundler (M)
100.00%

herdProtect (fuzzy)
a variant of e8fc53403b1ecfaa715539dafaf3c31ee17693d1
33.33%

Quick Heal
Adware.Domal.A5
33.33%

McAfee
RDN/Generic.bfr!gd
33.33%

Malwarebytes
PUP.Optional.BundleInstaller.A
33.33%

K7 AntiVirus
Trojan
33.33%

Agnitum Outpost
PUA.DomaIQ
33.33%

avast!
Win32:DomaIQ-BD [PUP]
33.33%

Kaspersky
not-a-virus:AdWare.MSIL.DomaIQ
33.33%

NANO AntiVirus
Riskware.Win32.DomaIQ.cspmgz
33.33%

Sophos
Generic PUA EB
33.33%

Comodo Security
Application.Win32.DomaIQ.X
33.33%

Dr.Web
Adware.Downware.2011
33.33%

VIPRE Antivirus
Trojan.Win32.Generic
33.33%

Avira AntiVirus
APPL/DomaIQ.AUP
33.33%

The domain nym2.ib.adnxs.com has been seen to resolve to the following 24 IP addresses.

68.67.153.4
float.2241.bm-impbus.prod.nym2.adnexus.net
April 12, 2016

68.67.152.133
float.1156.bm-impbus.prod.nym2.adnexus.net
April 12, 2016

68.67.152.82
float.1386.bm-impbus.prod.nym2.adnexus.net
April 12, 2016

68.67.152.67
float.1371.bm-impbus.prod.nym2.adnexus.net
April 12, 2016

68.67.177.254
float.2295.bm-impbus.prod.nym2.adnexus.net
April 12, 2016

68.67.176.63
float.2481.bm-impbus.prod.nym2.adnexus.net
April 12, 2016

68.67.153.178
float.2064.bm-impbus.prod.nym2.adnexus.net
April 12, 2016

68.67.153.59
float.1929.bm-impbus.prod.nym2.adnexus.net
April 12, 2016

68.67.176.48
float.1441.bm-impbus.prod.sin1.adnexus.net
April 10, 2016

68.67.176.40
float.1208.bm-impbus.prod.sin1.adnexus.net
April 10, 2016

68.67.153.65
float.1934.bm-impbus.prod.nym2.adnexus.net
April 10, 2016

68.67.153.55
float.1932.bm-impbus.prod.nym2.adnexus.net
April 10, 2016

68.67.153.41
float.2047.bm-impbus.prod.nym2.adnexus.net
April 10, 2016

68.67.152.121
float.1150.bm-impbus.prod.nym2.adnexus.net
April 10, 2016

68.67.152.66
float.1370.bm-impbus.prod.nym2.adnexus.net
April 10, 2016

68.67.176.56
float.2472.bm-impbus.prod.nym2.adnexus.net
April 10, 2016

68.67.152.143
float.1132.bm-impbus.prod.nym2.adnexus.net
February 8, 2014

68.67.152.95
float.1217.bm-impbus.prod.nym2.adnexus.net
February 8, 2014

68.67.152.174
float.1135.bm-impbus.prod.nym2.adnexus.net
February 8, 2014

68.67.152.181
float.1336.bm-impbus.prod.nym2.adnexus.net
February 8, 2014

68.67.152.209
February 8, 2014

68.67.152.127
float.1162.bm-impbus.prod.nym2.adnexus.net
February 8, 2014

68.67.152.222
February 8, 2014

64.208.138.129
float.1780.bm-impbus.prod.nym1.adnexus.net
February 8, 2014

File downloads found at URLs served by nym2.ib.adnxs.com.

1 / 68      (Adware)
http://nym2.ib.adnxs.com/click?ehSuR-F6lD8yVTAqqROQPwAAAAAAAPA_MlUwKqkTkD97FK5H4XqUP2g20SuzJlp_zL4YNQzNvlUpv9pSAAAAAGuSFADLBgAA7QgAAAIAAACdPLQATzcFAAAAAQBVU0QAVVNEANgCWgB9LwAAyKgAAgUCAQIAAIgAPCEPDwAAAAA./cnd=!zAYKPwiy360BEJ350AUYz-4UIAA./referrer=http://www.youtube.com/clickenc=http://clickus.datropy.com/st?cipid=289000&ttype=1&crid=589418&dast=Ym89MSZjaXBpZD0yODkwMDAmY2lzaWQ9RThDRUFCNjQzRTM1OTMyOTIwNDg0OTE5NCZjaXJpZD1FOENFQUI2NDNFMzU5MzMwMzExNzM2ODQ4JnN1YmlkPTEwMDgmY2l1aWQ9Nzc2NTY3NjY4Mzk4NDMzMDEzMiZzbz0xJmNyaWQ9NTg5NDE4JmV4Y2lkPTIyJmNudHJ5PTM4JmNpY21wPTc5MTc4JnB1YmlkPTQzMDA=&cmcv=${CMCV}&tgtf=http://traquee.com/.../32ceA8MZqvSzWjGe2tHC83xCm5hxvUcbHpzohaqEeL8?pid=144&tid=nym2CMz94qjDobPfVRACGOjsxN6y1omtfyIKNzAuMjcuNC42NSgBMKn-6pYF  (player setup.exe)

1 / 68      (Adware)
http://nym2.ib.adnxs.com/click?exSuR-F6lD_SAN4CCYqPP05iEFg5tNA_0gDeAgmKjz97FK5H4XqUPyVPvXQD_dd_zL4YNQzNvlUpv9pSAAAAAL8rHQCZBwAA7QgAAAIAAACcPLQAzEYEAAAAAQBVU0QAVVNEACwB-gA70gAAeaoAAQUCAQIAAIoAdiXFsAAAAAA./cnd=!ZAZkPQiy360BEJz50AUYzI0RIAA./referrer=http://www.youtube.com/watch/clickenc=http://traquee.com/.../32ceA8MZqvSzWjGe2tHC83xCm5hxvUcbHpzohaqEeL8?pid=144&tid=nym2CMz94qjDobPfVRACGKWe9aW3oP_rfyIKNzAuMjcuNC42NSgBMKn-6pYF  (player setup.exe)

21 / 68    (Adware)
http://nym2.ib.adnxs.com/click?exSuR-F6lD-PU3Qkl_-QP0w3iUFg5eQ_j1N0JJf_kD97FK5H4XqUP88phSznY80sRoHoCQSw6QbRk9tSAAAAAAbVIABoCAAA7QgAAAIAAACdPLQA3UwFAAAAAQBVU0QAVVNEANgCWgDaDwAAN7EAAgUCAQIAAIwAQydMkQAAAAA./cnd=!hgb_PQiy360BEJ350AUY3ZkVIAA./referrer=http://ib.adnxs.com/tt?id=2069745&size=728x90&cb=1390121934&referrer=${REFERRER_URL}&pubclick=http://nym2.ib.adnxs.com/click?4LpiRnh7UD8WpHREGQVMPylcj8L1KNQ_FqR0RBkFTD_gumJGeHtQP5jF9M4BJx8JRoHoCQSw6QbOk9tSAAAAAPb6HgDOAgAAMwMAAAIAAACR_KkAAhEFAAAAAQBVU0QAVVNEANgCWgB_oQAASLYAAQUCAQIAAIoAQSRsUAAAAAA./cnd=!yAWdNwidy6ABEJH5pwUYgqIUIAA./referrer=bokra.net/clickenc=/clickenc=http://traquee.com/.../32ceA8MZqvSzWjGe2tHC83xCm5hxvUcbHpzohaqEeL8?pid=144&tid=nym2CMaCos_AgOz0BhACGM_TlOTy_NjmLCINMjMuMTYuMjIyLjIxOCgBMNGn7pYF  (player setup.exe)

The following 16 files have been seen to comunicate with nym2.ib.adnxs.com in live environments.

TCP » 68.67.152.127:80
moyrap.exe (Maskiseft Visaal Studio 2010 by Maskiseft Corporatien)

TCP » 68.67.152.133:80
cmd.exe

TCP » 68.67.152.143:80
vxhost.exe (windows media)

TCP » 68.67.152.66:80
vxhost.exe (windows media)

TCP » 68.67.152.67:80
spd.exe

TCP » 68.67.152.82:80
vxhost.exe (windows media)

TCP » 68.67.152.95:80
foufb.exe (Cloud by Cloud Company)

TCP » 68.67.152.95:80
label.exe

TCP » 68.67.152.95:80
colormedia.exe (ColorMedia.exe by CartCrunch Israel)

TCP » 68.67.153.178:80
duuvri.exe (Maskiseft Visual Studio 2010 by Maskiseft)

TCP » 68.67.153.178:80
vxhost.exe

TCP » 68.67.153.41:80
vxhost.exe (windows media)

TCP » 68.67.153.41:80
client.exe

TCP » 68.67.153.41:80
roxyir.exe (by Nobemame Corporatu)

TCP » 68.67.153.55:80
compatibilitycheck.exe

TCP » 68.67.176.48:80
palemoon.exe (Pale Moon by Moonchild Productions)

TCP » 68.67.176.56:443
client.exe

TCP » 68.67.176.63:80
client.exe

TCP » 68.67.177.254:80
Client.exe

URL:
http://nym2.ib.adnxs.com/

Google Analytics:
UA-4057742

Title:
“error page for redirects from product”

Web server:
Apache/2.2.22 (Ubuntu)

aim4media.com

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.