home

www.new-jas-down-way9.biz

WhoisGuard, Inc.  (Proxy Registrant)

Domain Information

The domain www.new-jas-down-way9.biz is registered by proxy through ENOM, INC. and was originally registered in May of 2015. Currently this domain has been known to host various forms of malware. The hosted servers are located in Ashburn, Virginia within the United States which resides on the Amazon.com, Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform.
Registrar:
ENOM, INC.

Server location:
Virginia, United States (US)

Create date:
Saturday, May 23, 2015

Expires date:
Sunday, May 22, 2016

Updated date:
Saturday, May 23, 2015

ASN:
AS14618 AMAZON-AES - Amazon.com, Inc.,US

Root domain:
new-jas-down-way9.biz

Whois:
1 new-jas-down-way9.biz record

Google Safe Browsing:
unwanted

Scanner detections:
Malware distribution  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
Threat.Win.Reputation.IMP
100.00%

Emsisoft Anti-Malware
Application.Bundler.Amonetize.AY
33.33%

Lavasoft Ad-Aware
Application.Bundler.Amonetize.AY
33.33%

Kaspersky
not-a-virus:AdWare.Win32.Amonetize
33.33%

Bkav FE
HW32.Packed
33.33%

MicroWorld eScan
Application.Bundler.Amonetize.AY
33.33%

Agnitum Outpost
PUA.Amonetize
33.33%

Trend Micro House Call
TROJ_GEN.R0C1H07EO15
33.33%

Bitdefender
Application.Bundler.Amonetize.AY
33.33%

NANO AntiVirus
Riskware.Win32.Amonetize.drzmcl
33.33%

F-Secure
Application.Bundler.Amonetize
33.33%

Avira AntiVirus
ADWARE/Amonetize.679440.2
33.33%

G Data
Application.Bundler.Amonetize.AY
33.33%

AhnLab V3 Security
PUP/Win32.Amonetize
33.33%

Baidu Antivirus
PUA.Win32.Amonetize
33.33%

The domain www.new-jas-down-way9.biz has been seen to resolve to the following 2 IP addresses.

8.5.1.37
May 24, 2016

54.204.26.114
ec2-54-204-26-114.compute-1.amazonaws.com
May 28, 2015

File downloads found at URLs served by www.new-jas-down-way9.biz.

1 / 68      (Malware)
http://www.new-jas-down-way9.biz/download.php?monitor=1&version=1.1.6.20&campid=2785&prefix=Robin Hood: The Legend of Sherwood&instid[appname]=Robin Hood: The Legend of Sherwood  (robin hood- the legend of sherwood__2785_il1651369.exe)

1 / 68      (Malware)
http://www.new-jas-down-way9.biz/download.php?monitor=1&version=1.1.6.20&campid=2785&prefix=GTA: Vice City&instid[appname]=GTA: Vice City  (en drankers hytte frem fra glemselen.mp3__6092_il1656174.exe)

18 / 68    (PUP)
http://www.new-jas-down-way9.biz/download.php?monitor=1&version=1.1.6.20&campid=13300&prefix=woman in gold&instid[appname]=woman in gold  (woman in gold__13300_il1353176.exe)

The following file have been seen to comunicate with www.new-jas-down-way9.biz in live environments.

TCP » 8.5.1.37:80
securedocumentsviewer.crx

URL:
http://www.new-jas-down-way9.biz/

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
Apache/2.2.15 (Red Hat) (PHP/5.3.3)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.