home

pfn.dlhvit.com

Only contact by email, all postal mail will be rejected  (Proxy Registrant)

Domain Information

The domain pfn.dlhvit.com is registered by proxy through SOLUCIONES CORPORATIVAS IP, SL and was originally registered in June of 2015. The hosted servers are located in Roubaix, Nord-Pas-De-Calais within France which resides on the RIPE Network Coordination Centre network.
Registrar:
SOLUCIONES CORPORATIVAS IP, SL

Server location:
Nord-Pas-De-Calais, France (FR)

Create date:
Thursday, June 18, 2015

Expires date:
Saturday, June 18, 2016

Updated date:
Thursday, June 18, 2015

ASN:
AS16276 OVH OVH SAS,FR

Root domain:
dlhvit.com

Whois:
2 dlhvit.com records

Google Safe Browsing:
unwanted

Scan engine
Details
Detections

Reason Heuristics
(M), PUP.Optional.DsNET.Atube.Installer.Meta
75.00%

ESET NOD32
Win32/OpenCandy, Win32/Bundled.Toolbar.Ask.G potentially unsafe (variant)
50.00%

Malwarebytes
PUP.Optional.OpenCandy
25.00%

Dr.Web
Adware.Toolbar.282
25.00%

The domain pfn.dlhvit.com has been seen to resolve to the following 3 IP addresses.

185.53.177.20
July 22, 2016

149.202.192.156
ns3014179.ip-149-202-192.eu
March 31, 2016

37.59.34.142
ns237133.ovh.net
July 23, 2015

File downloads found at URLs served by pfn.dlhvit.com.

2 / 68
http://pfn.dlhvit.com/crawled_soft/2/.../25837-672503-winamp-full.exe  (winamp565_full_emusic-7plus_all.exe)

3 / 68      (PUP)
http://pfn.dlhvit.com/crawled_soft/7/.../79750-678514-atube-catcher.exe  (atubecatcher.exe)

0 / 68
http://pfn.dlhvit.com/crawled_soft/4/.../47395-93381-warcraft-iii-the-frozen-throne.exe  (f1591e95a89aa2ccf5265fb40d04e4f9)

1 / 68      (Malware)
http://pfn.dlhvit.com/crawled_soft/.../2/22461-675811-ares.exe  (aresregular230_installer.exe)

1 / 68      (Malware)
http://pfn.dlhvit.com/crawled_soft/3/.../36808-671362-counter-strike.exe  (Setup.exe)

0 / 68
http://pfn.dlhvit.com/crawled_soft/2/.../230969-672325-mortal-kombat-komplete-edition.msi  (SteamInstall.msi)

The following 87 files have been seen to comunicate with pfn.dlhvit.com in live environments.

TCP » 149.202.192.156:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 149.202.192.156:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 149.202.192.156:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 149.202.192.156:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 149.202.192.156:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 149.202.192.156:80
installer_counter-strike_1_6_spanish.exe

TCP » 149.202.192.156:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 149.202.192.156:80
installer_office_2007_11_0_6502_spanish.exe

TCP » 149.202.192.156:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 149.202.192.156:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 149.202.192.156:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 149.202.192.156:80
sysTPLService.exe (sysTPLService by Tlapia)

TCP » 149.202.192.156:80
WajamInternetEnhancer.exe (Wajam Internet Enhancer by Wajam Internet Technologies)

TCP » 149.202.192.156:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 149.202.192.156:80
Client.exe

TCP » 149.202.192.156:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 149.202.192.156:80
installer_halo_trial_1_01_spanish.exe (Installer web by Internet Installer)

TCP » 149.202.192.156:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 149.202.192.156:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 149.202.192.156:80
Client.exe

 
Latest 20 of 88 files

URL:
http://pfn.dlhvit.com/

Web server:
nginx

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.