The domain v4download.com registered by Whois Privacy Corp. was initially registered in December of 2013 through INTERNET.BS CORP.. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Phoenix, Arizona within the United States which resides on the CloudFlare, Inc. network. The domain uses the CloudFlare CDN, a distributed domain name server service which utilizes a number of reverse proxy IP Addresses (see below).
Registrant:
Whois Privacy Corp.
Registrar:
INTERNET DOMAIN SERVICE BS CORP
Server location:
Arizona, United States (US)
Create date:
Friday, December 20, 2013
Expires date:
Tuesday, December 20, 2016
Updated date:
Thursday, December 24, 2015
ASN:
AS13335 CLOUDFLARENET - CloudFlare, Inc.,US
Scanner detections:
Detections (95% detected)
Scan engine
Details
Detections
AhnLab V3 Security
PUP/Win32.Amonetize, Trojan/Win32.Gen
88.37%
ESET NOD32
Win32/Amonetize.BN (variant), Win32/Amonetize.BP (variant), Win32/Amonetize.BY (variant), Win32/Amonetize.CH (variant), Win32/Amonetize.BK (variant)
81.40%
Avira AntiVirus
Adware/Amonetize.tzw, Adware/Amonetize.505936, ADWARE/Adware.Gen2, ADWARE/Adware.Gen4, Adware/Amonetize.575168.1, Adware/Amonetize.575168.26
79.07%
Reason Heuristics
Threat.Win.Reputation.IMP, PUP.Installer.ITLGROUP.I, PUP.Installer.ITLGROUP.p, PUP.Installer.SVANTRANS.f, PUP.Installer.ITLGROUP.U, Adware.Amonetize.Installer.Installer.Meta (M)
74.42%
G Data
Gen:Variant.Graftor.154346, Trojan.GenericKD.1961750, Gen:Variant.Adware.Strictor.68509, Gen:Variant.Application.Jaik.4831
72.09%
Bitdefender
Gen:Variant.Graftor.154346, Trojan.GenericKD.1961750, Gen:Variant.Adware.Strictor.68509, Gen:Variant.Application.Jaik.4831
67.44%
MicroWorld eScan
Gen:Variant.Graftor.154346, Gen:Variant.Adware.Strictor.68509, Gen:Variant.Application.Jaik.4831, Win32.Virtob.Gen.12, Gen:Variant.Adware.Netfilter.2, Gen:Variant.Application.Bundler.Amonetize.11, Application.Bundler.Amonetize.AO, Gen:Variant.Application.Bundler.AirInstaller.1, Gen:Variant.Adware.Strictor.77177
65.12%
F-Secure
Gen:Variant.Graftor.154346, Trojan.GenericKD.1961750, Gen:Variant.Adware.Strictor.68509, Gen:Variant.Application.Jaik, Win32.Virtob.Gen.12
62.79%
Lavasoft Ad-Aware
Gen:Variant.Graftor.154346, Trojan.GenericKD.1961750, Gen:Variant.Adware.Strictor.68509, Gen:Variant.Application.Jaik.4831
60.47%
Qihoo 360 Security
HEUR/Malware.QVM18.Gen, HEUR/QVM10.1.Malware.Gen, Win32/Application.756, HEUR/QVM18.1.Malware.Gen, HEUR/QVM16.0.Malware.Gen
60.47%
McAfee
RDN/Generic PUP.x!cmm, Artemis!A899877F6401, Artemis!07F4C9BE54FD, Artemis!77A8C30E4081, Artemis!C5074D107539, Artemis!A66A5A0B0278, Artemis!25FA8E20472F
58.14%
Trend Micro House Call
Suspicious_GEN.F47V0909, Suspicious_GEN.F47V1120, Suspicious_GEN.F47V1115, Suspicious_GEN.F47V1205, Suspicious_GEN.F47V1209, Suspicious_GEN.F47V1213, Suspicious_GEN.F47V1226, Suspicious_GEN.F47V1231
53.49%
Sophos
Generic PUA AK, Generic PUA FM, Generic PUA KP, Generic PUA BG, Generic PUA MP, Generic PUA GN, Generic PUA NK, Generic PUA EO
53.49%
Fortinet FortiGate
Riskware/Amonetize, W32/Virut.CE, Adware/Amonetize, Adware/Generic
51.16%
avast!
Win32:Adware-gen [Adw], Win32:Dropper-gen [Drp], Win32:Amonetize-GN [PUP], Win32:Vitro, Win32:Malware-gen, Win32:Amonetize-GL [PUP]
48.84%
The domain v4download.com has been seen to resolve to the following 14 IP addresses.
(CloudFlare)
February 27, 2014
(CloudFlare)
February 27, 2014
File downloads found at URLs served by v4download.com.
Latest 30 of 120 download URLs
Subdomains
URL:
http://v4download.com/
SSL certificate subject:
CN=sni55611.cloudflaressl.com, OU=PositiveSSL Multi-Domain, OU=Domain Control Validated
SSL certificate issuer:
CN=COMODO ECC Domain Validation Secure Server CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
Web server:
cloudflare-nginx