home

um2.eqads.com

ALTER, RAFAEL

Domain Information

The domain um2.eqads.com registered by ALTER, RAFAEL was initially registered in June of 2009 through ENOM, INC.. The hosted servers are located in Reston, Virginia within the United States.
Registrar:
ENOM, INC.

Server location:
Virginia, United States (US)

Create date:
Wednesday, June 10, 2009

Expires date:
Friday, June 10, 2016

Updated date:
Saturday, December 19, 2015

ASN:
AS6461 ZAYO-6461 - Zayo Bandwidth Inc, US

Root domain:
eqads.com

Whois:
1 eqads.com record

The domain um2.eqads.com has been seen to resolve to the following IP address.

64.124.217.61
64.124.217.61.IPYX-126517-ZYO.zip.zayo.com
April 7, 2016

File downloads found at URLs served by um2.eqads.com.

0 / 68
http://um2.eqads.com/.../cs  (7c19fdb66d8faf591cdbf13fb262ccb1)

1 / 68      (Malware)
http://um2.eqads.com/.../cs  (filehost_counter-strike go pro.exe)

The following 35 files have been seen to comunicate with um2.eqads.com in live environments.

TCP » 64.124.217.61:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 64.124.217.61:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 64.124.217.61:443
browserairexec.exe (BrowserAir by Goobzo)

TCP » 64.124.217.61:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 64.124.217.61:80
1stbrowser.exe (1stBrowser by The 1stBrowser Authors)

TCP » 64.124.217.61:80
citrio.exe (Citrio by CatalinaGroup)

TCP » 64.124.217.61:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 64.124.217.61:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 64.124.217.61:80
browserairexec.exe (BrowserAir by Goobzo)

TCP » 64.124.217.61:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 64.124.217.61:443
citrio.exe (Citrio by CatalinaGroup)

TCP » 64.124.217.61:80
UCBrowser.exe (by UCWeb)

TCP » 64.124.217.61:443
apptrailers.exe

TCP » 64.124.217.61:80
UCBrowser.exe (by UCWeb)

TCP » 64.124.217.61:80
apptrailers.exe

TCP » 64.124.217.61:80
apptrailers.exe

TCP » 64.124.217.61:80
UCBrowser.exe (by UCWeb)

TCP » 64.124.217.61:80
UCBrowser.exe (by UCWeb)

TCP » 64.124.217.61:443
apptrailers.exe

TCP » 64.124.217.61:443
browser.exe (speed browser by Smart Applications)

 
Latest 20 of 58 files

URL:
http://um2.eqads.com/

SSL certificate subject:
CN=*.eqads.com, O=EQ Advertising Group Ltd, L=Toronto, S=Ontario, C=CA

SSL certificate issuer:
CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US

Web server:
nginx/1.4.6 (Ubuntu)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.