home

skype.ar.joydownload.com

Domains By Proxy, LLC  (Proxy Registrant)

Domain Information

The domain skype.ar.joydownload.com is registered by proxy through GODADDY.COM, LLC and was originally registered in March of 2013. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Ashburn, Virginia within the United States which resides on the Amazon.com, Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform.
Registrar:
GODADDY.COM, LLC

Server location:
Virginia, United States (US)

Create date:
Monday, March 18, 2013

Expires date:
Friday, March 18, 2016

Updated date:
Friday, May 1, 2015

ASN:
AS14618 AMAZON-AES - Amazon.com, Inc.,US

Root domain:
joydownload.com

Whois:
1 joydownload.com record

Scanner detections:
Detections  (80% detected)

Scan engine
Details
Detections

McAfee
Artemis!53E8DA892A7F, Artemis!2A2CC871B2C2, Artemis!A8A7204CE88D, Artemis!6D5AB4655359
100.00%

Malwarebytes
PUP.Optional.OpenCandy
100.00%

Agnitum Outpost
Riskware.Agent
100.00%

Trend Micro House Call
Suspici.792C221A, ADW_OPENCANDY, Suspicious_GEN.F47V1112, TROJ_GE.926EE4D5
100.00%

Clam AntiVirus
Win.Trojan.Agent-803351, Win.Trojan.Agent-855157
100.00%

Dr.Web
Adware.OpenCandy.55, Adware.Downware.9759
100.00%

AhnLab V3 Security
PUP/Win32.OpenCandy
100.00%

AVG
OpenCandy
100.00%

Baidu Antivirus
Adware.Win32.OpenCandy
100.00%

ESET NOD32
Win32/JoyDownloader, Win32/OpenCandy.C potentially unsafe (variant)
100.00%

Avira AntiVirus
APPL/Downloader.Gen
75.00%

Reason Heuristics
PUP.Installer.InnovativeSystems.K, PUP.Installer.InnovativeSystems.O
75.00%

VIPRE Antivirus
Opencandy, Trojan.Win32.Generic
75.00%

K7 AntiVirus
Unwanted-Program , Trojan
75.00%

NANO AntiVirus
Riskware.Win32.OpenCandy.cxlnia, Riskware.Win32.Downloader.dqybkl
75.00%

The domain skype.ar.joydownload.com has been seen to resolve to the following 5 IP addresses.

54.225.168.223
ec2-54-225-168-223.compute-1.amazonaws.com
May 24, 2016

50.19.96.56
ec2-50-19-96-56.compute-1.amazonaws.com
May 24, 2016

54.235.130.12
ec2-54-235-130-12.compute-1.amazonaws.com
June 30, 2015

23.23.159.111
ec2-23-23-159-111.compute-1.amazonaws.com
January 18, 2015

23.21.241.197
ec2-23-21-241-197.compute-1.amazonaws.com
January 18, 2015

File downloads found at URLs served by skype.ar.joydownload.com.

22 / 68    (Adware)
http://skype.ar.joydownload.com/get_azure_file/wUiS4WnYccXDyCf4UfO5CV530RJ0YyqsWxL3as6Q7qp2uHf14WJwwclRblXsK7H7NWH7mQoMbSTPCeLkErY90fk5kNSWRAaS9T35D0Dlszi1iP/D94CMg2gIq5c6kVdGRn3kADx/hodt7CC5UGKTUr1Ow4TrMz0VPuBuegoEcKX2UnBtO5WHZk5h2eWhUjhwMNDg2q4/CGOo5AWTyKouFpn esGkfXNf3tO2XuMnlQ9TtNzvhhvyaKBnlS6kB8lY/.../jocTY2nViMqRIHI48PX4lsuanFR9jhVW61NdWUHW1FAaqqZvvig==  (skypesetup.exe)

16 / 68    (PUP)
http://skype.ar.joydownload.com/.../wUiS4WnYccXBwj zXP7oQkEsml0kPDi1E1v4ZNbB47pquHf14WJzz9EcThyuKO6fajf5gEoNejaeEKqtHr8llvEgnYTIFQfI9S78DkH3un27ivfa7dPam3EP5Yc7wF9DXmSmGDU2nsUj7H2lBjfMAq5Xi83jPSUGbKs5bBIOM6XlAiM8OJKfb15g0LPvUSwgcpexiqR1W3ux8VDMlu0qXcave4GkaXtO3cO4HugjjRZW54v3nxihOrh 1CalCd1c7cGpSDrjsZuCxW8ybPVJQo4vfiZ95L3gXghqzRyz3c8HSnjzDVT5opGp  (skypesetup.exe)

23 / 68    (Adware)
http://skype.ar.joydownload.com/get_azure_file/wUiS4WnYccXEwj 8WvauHEA0kxQ8PDK1GhvzcteQv c8/zOn/j1gwJgELEPtevindjPpgwEcdyOSTqHyCr50ybpq1p/EUx6avCX6BlT1vGm0yP/.../8umxBitfKE2nSqsEZoVrp75Fmvi6puRni0lY7BCRIY0Mjwps i1W0M1nB3z3dtOAS7jBAn1pojvig==  (skypesetup.exe)

22 / 68    (Adware)
http://skype.ar.joydownload.com/get_azure_file/wUiS4WnYccXBwj zXP7oQkEsml0kPTy1E1v4YdzZp7dvriWi8yE3iYccJgTtbbHufCj1gAFKOSCGGOO1W xj0bI5zseWRAaT9T28SFT8 3G gefQvNKbm2VBs8B4wwwAAWSsUzR0kMIu/ir UmCQS/9WzM3zYW5bPas5bBION6XlFSE2OJuNc19nzL xWnM3c8b41 cnWDbm5g NjvQvDpG3YsCtbmNXnMu/F/t73A8eroL6h0q/N/QhyGvlEcQe5MSxUT w54Ob2SYmbaRBR4Y5P3oxu6GtHhBzzk/.../rFAzwpYjvig==  (skypesetup.exe)

0 / 68
http://skype.ar.joydownload.com/get_azure_file/wUiS4WnYccXAwj uQbjxCggnkkU3LTPkEh74comb9bp0uHf1 2Jzz9kMJEfiarr5NDC2wl5KbSCeEKqtH78lhOA kJnaRB6avCX7BlS34S tgLbbrdPKkGBNs55ziVZIRi/ Xix 18kr9Dn5WnGSA7ZdyM3zY25EKOVjZl1Nb738FXB6ctyNfVJi2bPvUSwmcpe0iLknBSqwtFDdnv1pB5O6YsntZXdWzZfiQb1x3Q8eroL/.../U0WmsZGp  (SkypeSetup.exe)

22 / 68    (Adware)
http://skype.ar.joydownload.com/get_azure_file/wUiS4WnYccXBwj zXP7oQkEsml0kPTy1E1v4Y9bB87pi/269qG542dkML0Phban3fHm6ykYObT/YTqu1E/Y9wLNyxsWcFQfS9SnyHhO/ CL93ufa99PZlWJMpJQwhl1BXzWtCz5/.../8kSa1Kp D9G3c8i8LygIzcr F oujRwW65r2zlL6ZLgq1D6tQMVa5NX8Gie97NbTiCdjbbRJV8B5K3RguuOtDxtzhVW61NdWUHW1FAaqqZvvig==  (skypesetup.exe)

14 / 68    (Adware)
http://skype.ar.joydownload.com/get_azure_file/wUiS4WnYccXEwj 8WvauHEA0kxQ8PTK1Hhnga5/Zsekkuzyi93p5iNEPJU31K C1fyb/lRAdcjXJR7W5Tf1i0bIjzsWXFUzIqz3zT0z0smm iPPDpZrSkmlZ58xkkV4BXnCtGDx3kMUh9jnxGWmfSq4JgIe4dWIVY A4LhwOO6v2VH5/fcWNLBgonuK9RjQuIY/z2q4/.../lSa0XIxP5YSxRHP79MjOznNnJKRIBo48OXUx5LvkXUYwx1Pyi89PUCbkDB w NOkkh0ucw==  (skypesetupfull.exe)

The following file have been seen to comunicate with skype.ar.joydownload.com in live environments.

TCP » 23.21.241.197:80
install_flash_player-oc-jd.exe

URL:
http://skype.ar.joydownload.com/

Title:
“Skype download - تحميل Skype الإصدار 7.1اللغة العربية في JoyDownload”

Description:
“بإختصار Skype - سكايب هو برنامج مجانى للرسائل الفوريه والمكالمات الصوتية ومكالمات الفيديو مجاناً بالكامل - تحميل Skype الإصدار الأخير هنا.”

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
nginx/1.7.6 (PHP/5.3.10-1ubuntu3.8)

Facebook:
Likes:  34
Shares:  176
Comments:  5

Twitter:
Shares:  3

Statistics are for the previous month.

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.