The domain safe-secure2.com registered by MB MANAGEMENT GROUP was initially registered in November of 2015 through GODADDY.COM, LLC. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Dulles, Virginia within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Cloudfront CDN service which utilizes a number of proxy IP Addresses (see below).
Registrant:
MB MANAGEMENT GROUP
Registrar:
GODADDY.COM, LLC
Server location:
Virginia, United States (US)
Create date:
Friday, November 27, 2015
Expires date:
Sunday, November 27, 2016
Updated date:
Friday, November 27, 2015
ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US
Scanner detections:
Detections (95% detected)
Scan engine
Details
Detections
Reason Heuristics
PUP.Rainmaker.SANDDOLL.Installer.Meta (L), (M), Threat.Win.Reputation.IMP, PUP.Compete.Meta (M), PUP.Outbrowse.Installer.Meta (M), PUP.Rainmaker.PPCsoftw.Installer.Meta (L)
83.72%
Microsoft Security Essentials
Worm:Win32/NeksMiner.A, Threat.Undefined
16.28%
ESET NOD32
Detection.Undefined, Win32/Sality.NAR virus, Win32/Parite.B virus, Win32/Sality.NBA virus
16.28%
Dr.Web
Win32.Sector.5, Win32.Parite.2, Win32.Sector.30, riskware program Program.Unwanted.1284, Win32.Parite.2
16.28%
avast!
Win32:Kukacka, Win32:Parite, Win32:Sality
13.95%
McAfee
Virus.W32/Sality.gen.z, Virus.W32/Pate.b
13.95%
Emsisoft Anti-Malware
Win32.Sality.OG, Win32.Parite
11.63%
VIPRE Antivirus
Threat.416209, Threat.46249, Threat.4721115
11.63%
Kaspersky
Virus.Win32.Sality, Virus.Win32.Parite
11.63%
Norman
Win32.Sality.OG, Win32.Parite.B, Win32.Sality.3
11.63%
F-Prot
W32/Sality.AK, W32/Sality.E.gen, W32/Sality.gen2, W32/Parite.B
9.30%
AVG
Win32/Parite, Win32/Sality
9.30%
F-Secure
Application:W32/Generic.70053c248f!Online, Win32.Sality.3, Win32.Parite.B
6.98%
Sophos
Virus 'W32/Sality-AM', Virus 'Mal/Sality-D'
4.65%
Clam AntiVirus
W32.Sality-57
2.33%
The domain safe-secure2.com has been seen to resolve to the following 123 IP addresses.
server-52-84-125-21.iad16.r.cloudfront.net
August 27, 2016
server-52-84-125-253.iad16.r.cloudfront.net
August 27, 2016
server-52-84-125-226.iad16.r.cloudfront.net
August 27, 2016
server-52-84-125-199.iad16.r.cloudfront.net
August 27, 2016
server-52-84-125-134.iad16.r.cloudfront.net
August 27, 2016
server-52-84-125-119.iad16.r.cloudfront.net
August 27, 2016
server-52-84-125-45.iad16.r.cloudfront.net
August 27, 2016
server-52-84-125-44.iad16.r.cloudfront.net
August 27, 2016
server-54-192-19-5.iad12.r.cloudfront.net
August 27, 2016
server-54-192-19-254.iad12.r.cloudfront.net
August 27, 2016
server-54-192-19-231.iad12.r.cloudfront.net
August 27, 2016
server-54-192-19-163.iad12.r.cloudfront.net
August 27, 2016
server-54-192-19-111.iad12.r.cloudfront.net
August 27, 2016
server-54-192-19-102.iad12.r.cloudfront.net
August 27, 2016
server-54-192-19-55.iad12.r.cloudfront.net
August 27, 2016
server-54-192-19-29.iad12.r.cloudfront.net
August 27, 2016
server-52-85-142-247.iad12.r.cloudfront.net
May 26, 2016
server-52-85-131-172.iad53.r.cloudfront.net
May 24, 2016
server-52-85-142-250.iad12.r.cloudfront.net
May 18, 2016
server-52-85-142-241.iad12.r.cloudfront.net
May 18, 2016
server-52-85-142-196.iad12.r.cloudfront.net
May 18, 2016
server-52-85-142-152.iad12.r.cloudfront.net
May 18, 2016
server-52-85-142-138.iad12.r.cloudfront.net
May 18, 2016
server-52-85-142-55.iad12.r.cloudfront.net
May 18, 2016
server-52-85-142-27.iad12.r.cloudfront.net
May 18, 2016
server-52-85-131-147.iad53.r.cloudfront.net
May 17, 2016
server-52-85-131-70.iad53.r.cloudfront.net
May 17, 2016
server-52-85-131-60.iad53.r.cloudfront.net
May 17, 2016
server-52-85-131-6.iad53.r.cloudfront.net
May 17, 2016
server-52-85-131-198.iad53.r.cloudfront.net
May 17, 2016
Showing 30 of 123 IP Addresses
File downloads found at URLs served by safe-secure2.com.
The following 161 files have been seen to comunicate with safe-secure2.com in live environments.
URL:
http://safe-secure2.com/
Network:
Amazon Cloudfront