The domain v4download2.biz is registered by proxy through INTERNET.BS CORP. and was originally registered in August of 2014. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Phoenix, Arizona within the United States which resides on the CloudFlare, Inc. network. The domain uses the CloudFlare CDN, a distributed domain name server service which utilizes a number of reverse proxy IP Addresses (see below).
Registrant:
Fundacion Private Whois
Registrar:
INTERNET.BS CORP.
Server location:
Arizona, United States (US)
Create date:
Sunday, August 31, 2014
Expires date:
Sunday, August 30, 2015
Updated date:
Sunday, August 31, 2014
ASN:
AS13335 CLOUDFLARENET - CloudFlare, Inc.,US
Scanner detections:
Detections (100% detected)
Scan engine
Details
Detections
Avira AntiVirus
ADWARE/Adware.Gen2, Adware/Amonetize.fhz, TR/Crypt.XPACK.Gen, ADWARE/Adware.Gen4, Adware/Amonetize.575680.17
88.89%
AhnLab V3 Security
PUP/Win32.Amonetiz, Trojan/Win32.Gen
88.89%
ESET NOD32
Win32/Amonetize.AJ (variant), Win32/Amonetize.AT (variant), Win32/Amonetize.BP (variant), Win32/Amonetize.CH (variant), Win32/Amonetize.CK (variant)
77.78%
Sophos
Generic PUA JL, Generic PUA HP, Generic PUA GA, Generic PUA AA, Generic PUA FM, Generic PUA KD, Generic PUA BJ, Generic PUA MP, Generic PUA NK
77.78%
Malwarebytes
PUP.Optional.Amonetize.A, Trojan.Dropper.KJG, Trojan.Downloader.Agent
72.22%
McAfee
RDN/Generic PUP.x!c2i, Artemis!65F068EA0880, Artemis!BC89FC056AA2, Artemis!A899877F6401, Artemis!4D93010DD667, Artemis!31E1812D429E, Artemis!C5074D107539
72.22%
avast!
Win32:Malware-gen, Win32:Dropper-gen [Drp], Win32:Amonetize-ED [PUP], Win32:Adware-gen [Adw], Win32:Vitro, Win32:Amonetize-GN [PUP]
72.22%
G Data
Win32.Application.Amonetize, Trojan.GenericKD.1905906, Trojan.GenericKD.1961750, Gen:Variant.Adware.Kazy.385069, Trojan.GenericKD.1968718
66.67%
AVG
Generic_r, Win32/Heur, Generic5
66.67%
Qihoo 360 Security
Win32/Virus.Adware.932, HEUR/Malware.QVM18.Gen, HEUR/QVM18.1.Malware.Gen, HEUR/QVM10.1.Malware.Gen
66.67%
Fortinet FortiGate
Riskware/Amonetize, Adware/Amonetize, W32/Virut.CE
66.67%
Kaspersky
not-a-virus:HEUR:AdWare.Win32.Amonetize, not-a-virus:AdWare.Win32.Amonetize
61.11%
VIPRE Antivirus
Amonetize, Trojan.Win32.Generic, Threat.4150696
55.56%
Reason Heuristics
Threat.Win.Reputation.IMP, PUP.Installer.ITLGROUP.f, PUP.Installer.SVANTRANS.f, PUP.Installer.SVANTRANS.a, PUP.Installer.AMGRUP.DD
55.56%
Bkav FE
HW32.Paked, W32.HfsAutoA, HW32.Packed
50.00%
The domain v4download2.biz has been seen to resolve to the following 6 IP addresses.
File downloads found at URLs served by v4download2.biz.
URL:
http://v4download2.biz/
SSL certificate subject:
CN=sni50105.cloudflaressl.com, OU=PositiveSSL Multi-Domain, OU=Domain Control Validated
SSL certificate issuer:
CN=COMODO ECC Domain Validation Secure Server CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
Web server:
cloudflare-nginx