home

s42cq22f44yavg3.javoki.ru

CORLEON GROUP LTD

Domain Information

The domain s42cq22f44yavg3.javoki.ru registered by CORLEON GROUP LTD was initially registered in June of 2014 through REGRU-REG-RIPN. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Amsterdam, Noord-Holland within Netherlands which resides on the RIPE Network Coordination Centre network.
Registrar:
REGRU-REG-RIPN

Server location:
Noord-Holland, Netherlands (NL)

Create date:
Thursday, June 19, 2014

Expires date:
Friday, June 19, 2015

ASN:
AS59711 FORTUNIX-AS Fortunix Networks L.P.,GB

Root domain:
javoki.ru

Whois:
1 javoki.ru record

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.CORLEONGROUP.U, PUP.CORLEONGROUP.?, PUP.InstallMonster.CORLEONGROUP (M)
100.00%

VIPRE Antivirus
Threat.4845009
20.00%

avast!
Win32:InstallMonstr-DY [PUP]
20.00%

NANO AntiVirus
Trojan.Win32.InstallMonster.dbipfy
20.00%

Sophos
Install Monster
20.00%

Avira AntiVirus
APPL/InstallMonster.Gen
20.00%

G Data
Win32.Application.Installmonstr
20.00%

Vba32 AntiVirus
BScope.Downware.InstallMonstr
20.00%

Rising Antivirus
PE:Trojan.Agentb!6.211
20.00%

Panda Antivirus
PUP/InstallMonstr
20.00%

herdProtect (fuzzy)
a variant of f084c9f3191f1cbe430c346dcf97b03e43e2636e
20.00%

The domain s42cq22f44yavg3.javoki.ru has been seen to resolve to the following IP address.

5.149.254.184
July 10, 2014

File downloads found at URLs served by s42cq22f44yavg3.javoki.ru.

1 / 68      (Adware)
http://s42cq22f44yavg3.javoki.ru/get_file/?sid=23&url=http://stream.get-tune.net/listen/220836110/7276460/3642211148/.../SULTAN-URAGAN_i_Murat_Thagalegov_-_Na_diskoteku_NEW_2013_(get-tune.net).mp3&name=SULTAN-URAGAN_i_Murat_Thagalegov_-_Na_diskoteku_NEW_2013_(get-tune.net).mp3&type=mp3&size=6723367  (sultan-uragan_i_murat_thagalegov_-_na_diskoteku_new_2013_(get-tune.net).exe)

1 / 68      (Adware)
http://s42cq22f44yavg3.javoki.ru/.../?j=c2lkPTMwMTAmdXJsPWh0dHAlM0ElMkYlMkY2LmJlenNtcy5vcmclMkZmaWxlcyUyRjglMkY4NXRpdG9xYm5xdzllMSUyRlN0YW5kLnVwLjIwLmF2aSZuYW1lPVN0YW5kLnVwLjIwLmF2aSZ0eXBlPXZpZGVvJnNpemU9NTkzOTUyMDY0  (stand.up.20.exe)

1 / 68      (Adware)
http://s42cq22f44yavg3.javoki.ru/get_file/?sid=23&url=http://stream.get-tune.net/listen/120639445/81589348/3162242307/.../Agata_Kristi_-_Po_nebu_angely_letyat_v_kanave_dyavoly_polzut_i_te_i_eti_govoryat_Ty_nam_ne_vrag_ty_(get-tune.net).mp3&name=Agata_Kristi_-_Po_nebu_angely_letyat_v_kanave_dyavoly_polzut_i_te_i_eti_govoryat_Ty_nam_ne_vrag_ty_(get-tune.net).mp3&type=mp3&size=5803907  (0a19e91e75d2d10f5a7fa98bde0e16ce)

11 / 68    (Adware)
http://s42cq22f44yavg3.javoki.ru/get_file/?sid=23&url=http://stream.get-tune.net/listen/201073219/-26206708/528730653/.../Kendra_Morris_-_Shine_On_You_Crazy_Diamond_OST_Odnim_menshe_2_chast_trejlera_(get-tune.net).mp3&name=Kendra_Morris_-_Shine_On_You_Crazy_Diamond_OST_Odnim_menshe_2_chast_trejlera_(get-tune.net).mp3&type=mp3&size=3286009  (Kendra_Morris_-_Shine_On_You_Crazy_Diamond_OST_Odnim_menshe_2_chast_trejlera_(get-tune.net).exe)

1 / 68      (Adware)
http://s42cq22f44yavg3.javoki.ru/.../?j=c2lkPTI5NDgmdXJsPWh0dHAlM0ElMkYlMkZuYXJvZC5ydSUyRmRpc2slMkY1NTc5MzcwNjAwMS4zMTg2ZTY3MzI1MWQ2YzJjMGQxNDczYTYwMTAwMWZmZiUyRkRMTC1GaWxlcy5jb20uRml4ZXIudjIuNy43Mi4yMDcyLnJhci5odG1sJm5hbWU9RExMLUZpbGVzLmNvbStGaXhlcisyLjcuNzIuMjA3MislMkIrJUQwJUJBJUQwJUJCJUQxJThFJUQxJTg3JnR5cGU9YXJjaGl2ZSZzaXplPQ  (dll-files.com fixer 2.7.72.exe)

URL:
http://s42cq22f44yavg3.javoki.ru/

Web server:
nginx/1.4.2 (PHP/5.4.17)

faphib.ru

olghai.ru

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.