» www.cml1234.com
Overview
Analysis
IPs Addresses (1)
Downloads (122)
Network (1)
Website Detail

www.cml1234.com

WHOISGUARD, INC. (Proxy Registrant)

Domain Information

The domain www.cml1234.com is registered by proxy through ENOM, INC. and was originally registered in May of 2013. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in San Antonio, Texas within the United States.

Registrant:

WHOISGUARD, INC.

Registrar:

ENOM, INC.

Server location:

Texas, United States (US)

Create date:

Friday, May 24, 2013

Expires date:

Sunday, May 24, 2015

Updated date:

Thursday, May 22, 2014

ASN:

AS33070 RMH-14 - Rackspace Hosting

Root domain:

cml1234.com

Whois:

3 cml1234.com records

Scanner detections:

Detections (86% detected)

Scan engine

Details

Detections

Reason Heuristics

PUP.Installer.InstallX.T, PUP.Installer.SecureInstall.L, PUP.Win.Reputation, PUP.Installer.InstallX.O, PUP.Installer.InstallX.K

92.86%

Sophos

InstallQ, DomainIQ pay-per install

85.71%

VIPRE Antivirus

InstallIQ Installer

85.71%

Malwarebytes

PUP.Optional.InstallIQ, PUP.PlayPickle, PUP.Optional.SafeInstall.A

78.57%

Dr.Web

Adware.W3i.32, Adware.Searcher.2593, Adware.Downware.2512, Adware.Downware.2968

78.57%

ESET NOD32

Win32/InstallIQ (variant)

78.57%

McAfee

Artemis!E328593BCF74, Artemis!A34F9AC02DB1, Artemis!19D4CE24463F, Artemis!D8FA10DDD56E, Artemis!25CCAE59E743, Artemis!0A5C34E01EB3, Artemis!55A23E51D1FA, Artemis!226159AD828B

64.29%

Comodo Security

Application.Win32.InstallIQ.B

64.29%

AVG

Skodna.Generic_c, Skodna.Generic_r, MultiBundle

64.29%

Avira AntiVirus

APPL/InstallIQ.Gen5, Adware/InstallIQ.N, APPL/InstallIQ.J, APPL/InstallIQ.Gen4

57.14%

IKARUS anti.virus

Win32.SuspectCrc, AdWare.InstallIQ, Virus.Win32.Heur, APPL, PUA.InstallIQ

50.00%

K7 AntiVirus

Riskware, Unwanted-Program

50.00%

Trend Micro House Call

TROJ_GEN.F47V0815, TROJ_GEN.F47V0411, TROJ_GEN.F47V0813, TROJ_GEN.R0C2C0EK814, TROJ_GEN.F47V0717

35.71%

Rising Antivirus

PE:PUF.InstallIQ!1.9E4F, PE:Trojan.Win32.Generic.1585D070!361091184

35.71%

G Data

Adware.InstallIQ, Win32.Application.InstallIQ, Adware.Generic.669720, Gen:Variant.Application.Bundler.Graftor.155902

35.71%

The domain www.cml1234.com has been seen to resolve to the following IP address.

98.129.229.201

stories.rackspace.com

August 5, 2013

File downloads found at URLs served by www.cml1234.com.

23 / 68 (Adware)

http://www.cml1234.com/downloadprem.php?tn=10295b627810446f3612de0d31bfbe&aff=1066 (vioplayer2_d3795753.exe)

23 / 68 (Adware)

http://www.cml1234.com/downloadprem.php?tn=1029f8d604bd7b0e51fd2cb69eaedb&aff=3404 (vioplayer2_d3795753.exe)

19 / 68 (Adware)

http://www.cml1234.com/downloadprem.php?tn=102a4f74cc349f2e6ebd58ea8f58ec&aff=2950 (vioplayer2_d6238945.exe)

23 / 68 (Adware)

http://www.cml1234.com/downloadprem.php?tn=10219c1eb9530da4bd7cb3591a0906&aff=10608 (vioplayer2_d3795753.exe)

23 / 68 (Adware)

http://www.cml1234.com/downloadprem.php?tn=102e5c2b219a2bdf956f25e1102b40&aff=7656 (vioplayer2_d3795753.exe)

23 / 68 (Adware)

http://www.cml1234.com/downloadprem.php?tn=102d17f1919f596bcbea0560248b94&aff=1066 (vioplayer2_d3795753.exe)

26 / 68 (Adware)

http://www.cml1234.com/fdmdown.php?tn=102e6f77280937d3a554858603f5b0&aff=4360 (freedomdownload.exe)

13 / 68 (Adware)

http://www.cml1234.com/downloadprem.php?tn=102096a71919512498db09bd3b6046&aff=5302 (vioplayer2_d3993116.exe)

12 / 68 (Adware)

http://www.cml1234.com/downloadprem.php?tn=1020ff3621e45e6d6f6af9cc79f156&aff=4332 (vioplayer2_d3993213.exe)

12 / 68 (Adware)

http://www.cml1234.com/downloadprem.php?tn=1020ff3621e45e6d6f6af9cc79f156&aff=9260 (vioplayer2_d3993213.exe)

12 / 68 (Adware)

http://www.cml1234.com/downloadprem.php?tn=10255254f6d7411fc8a5fc1fd4b469&aff=7812 (vioplayer2_d3993213.exe)

12 / 68 (Adware)

http://www.cml1234.com/downloadprem.php?tn=102a8db0eff159fd22c35402c68ddc&aff=3427 (vioplayer2_d3993213.exe)

13 / 68 (Adware)

http://www.cml1234.com/downloadprem.php?tn=102499a4e8969251dbc76045089cab&aff=4936 (vioplayer2_d3993116.exe)

13 / 68 (Adware)

http://www.cml1234.com/downloadprem.php?tn=102499a4e8969251dbc76045089cab&aff=7260 (vioplayer2_d3993116.exe)

13 / 68 (Adware)

http://www.cml1234.com/downloadprem.php?tn=102d369e8461991556de8999c56d3d&aff=9398 (vioplayer2_d3993116.exe)

13 / 68 (Adware)

http://www.cml1234.com/downloadprem.php?tn=102544e0d2f069812a47dd4ff6ee87&aff=5800 (vioplayer2_d3993116.exe)

8 / 68 (Adware)

http://www.cml1234.com/downloadprem.php?tn=1022c0132ff6f1a34e26f4a27cbdb2&aff=9300 (vioplayer2_d3993135.exe)

8 / 68 (Adware)

http://www.cml1234.com/downloadprem.php?tn=1022c0132ff6f1a34e26f4a27cbdb2&aff=3404 (vioplayer2_d3993135.exe)

19 / 68 (Adware)

http://www.cml1234.com/downloadprem.php?tn=102b20f56f72f7a8808c76201d2250&aff=7656 (vioplayer2_d6238945.exe)

12 / 68 (Adware)

http://www.cml1234.com/downloadprem.php?tn=10200390a1146d452b7e656dfe6716&aff=3546 (vioplayer2_d3993213.exe)

12 / 68 (Adware)

http://www.cml1234.com/downloadprem.php?tn=10200390a1146d452b7e656dfe6716&aff=4388 (vioplayer2_d3993213.exe)

12 / 68 (Adware)

http://www.cml1234.com/downloadprem.php?tn=1025e6e0948d45824c0c20d2e71219&aff=3404 (vioplayer2_d3993213.exe)

23 / 68 (Adware)

http://www.cml1234.com/downloadprem.php?tn=1021c14d81e6f6a40856d104cb6e20&aff=6610 (vioplayer2_d3795753.exe)

23 / 68 (Adware)

http://www.cml1234.com/downloadprem.php?tn=1021c14d81e6f6a40856d104cb6e20&aff=3165 (vioplayer2_d3795753.exe)

14 / 68 (Adware)

http://www.cml1234.com/downloadprem.php?tn=102dcf4e7760de4c787b163453e0a2&aff=7920 (vioplayer2_d3993153.exe)

1 / 68 (false positive)

http://www.cml1234.com/downloadprem.php?tn=102b5cdf56bf822482e31f7485967e&aff=7400 (shsetup.exe)

24 / 68 (Adware)

http://www.cml1234.com/downloadvio2.php?tn=102bfea77a74318a5cee86f2cc8571&aff=12172 (vioplayerv.exe)

19 / 68 (Adware)

http://www.cml1234.com/downloadprem.php?tn=102940114f8c167aaffcbb764ad03b&aff=3398 (vioplayer2_d6238945.exe)

13 / 68 (Adware)

http://www.cml1234.com/downloadprem.php?tn=102f07e040cac7b94085faa2ff4899&aff=2936 (vioplayer2_d3993116.exe)

23 / 68 (Adware)

http://www.cml1234.com/downloadprem.php?tn=102d9054493f6efd2d504a7d103b43&aff=8468 (vioplayer2_d3795753.exe)

Latest 30 of 122 download URLs

The following file have been seen to comunicate with www.cml1234.com in live environments.

TCP » 98.129.229.201:80

online-guardian-v2.0.9.exe

URL:

http://www.cml1234.com/

Title:

“New Site”

Web server:

Apache/2.2

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.