home

www.yomtovoko.info

NameFind LLC

Domain Information

This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Scottsdale, Arizona within the United States which resides on the GoDaddy.com, LLC network.
Registrar:
GoDaddy.com, LLC

Server location:
Arizona, United States (US)

ASN:
AS26496 AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC

Root domain:
yomtovoko.info

Whois:
4 yomtovoko.info records

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Bundler.installCore, PUP.InstallCore.Installer.Installer (M), PUP.InstallCore.Bundler (M), PUP.InstallCore.FC.Installer (M), PUP.InstallCore.AFF.Installer.Meta (M), PUP.InstallCore.FC (M), PUP.InstallCore.AFF (M)
81.63%

VIPRE Antivirus
Threat.4786018, Threat.4788237
24.49%

ESET NOD32
Win32/InstallCore.VW potentially unwanted application, Win32/InstallCore.WQ potentially unwanted application, Win32/InstallCore.WI potentially unwanted application, Win32/InstallCore.ADX.gen potentially unwanted application
24.49%

G Data
Win32.Application.InstallCore.CZ, Win32.Application.InstallCore.EG
22.45%

Dr.Web
Trojan.InstallCore.60, Trojan.InstallCore.55, Trojan.InstallCore.53
22.45%

Avira AntiVirus
Adware/InstallCo.zlx, APPL/InstallCore.791547, ADWARE/InstallCo.RE, PUA/InstallCo.TW, Adware/InstallCo.jms, PUA/InstallCo.RE
20.41%

Malwarebytes
PUP.Optional.Bundle, PUP.Optional.InstallCore.A
18.37%

Comodo Security
Application.Win32.InstallCore.DSG, Application.Win32.InstallCore.LK
18.37%

NANO AntiVirus
Riskware.Win32.InstallCore.dotkes, Riskware.Win32.InstallCore.dnxjxy
16.33%

Vba32 AntiVirus
Malware-Cryptor.InstallCore.gen
14.29%

AVG
Generic
4.08%

herdProtect (fuzzy)
a variant of 47390a6a8691f872b56931c5ac7aabb8a3fe4669, a variant of 5ada3a05fb062e0c49883bddb59a700b21d9c536
4.08%

Zillya! Antivirus
Tool.ArchSMS.Win32.26513
4.08%

Agnitum Outpost
PUA.InstallCore
4.08%

Qihoo 360 Security
HEUR/QVM06.1.Malware.Gen
4.08%

The domain www.yomtovoko.info has been seen to resolve to the following 14 IP addresses.

208.73.211.70
April 17, 2016

141.8.224.239
February 11, 2016

184.168.221.56
ip-184-168-221-56.ip.secureserver.net
January 4, 2016

52.5.253.65
ec2-52-5-253-65.compute-1.amazonaws.com
November 25, 2015

54.209.201.192
ec2-54-209-201-192.compute-1.amazonaws.com
November 25, 2015

52.22.183.105
ec2-52-22-183-105.compute-1.amazonaws.com
November 25, 2015

52.7.229.133
ec2-52-7-229-133.compute-1.amazonaws.com
October 20, 2015

52.4.83.252
ec2-52-4-83-252.compute-1.amazonaws.com
October 20, 2015

54.210.9.221
ec2-54-210-9-221.compute-1.amazonaws.com
October 20, 2015

52.0.99.229
ec2-52-0-99-229.compute-1.amazonaws.com
August 11, 2015

54.175.54.85
ec2-54-175-54-85.compute-1.amazonaws.com
August 11, 2015

52.6.136.173
ec2-52-6-136-173.compute-1.amazonaws.com
August 11, 2015

54.164.240.249
ec2-54-164-240-249.compute-1.amazonaws.com
July 23, 2015

52.5.229.114
ec2-52-5-229-114.compute-1.amazonaws.com
June 26, 2015

File downloads found at URLs served by www.yomtovoko.info.

1 / 68      (PUP)
http://www.yomtovoko.info/3fddfe63-56dc-424b-a44f-3cd2fe02a5d3?subid=CNT  (downloadmanagersetup.exe)

The following 124 files have been seen to comunicate with www.yomtovoko.info in live environments.

TCP » 184.168.221.56:80
googleupdate.exe13d7b73 (globalUpdate Update by globalUpdate)

TCP » 184.168.221.56:80
object browser-codedownloader.exe (Object Browser)

TCP » 184.168.221.56:80
c01208e4-b2ad-40c1-9810-40447884a00b-9.exe

TCP » 184.168.221.56:80
iwebar-codedownloader.exe (iWebar)

TCP » 184.168.221.56:80
4132a714-32df-4151-aae1-b56eb1d2e3f3-7.exe (Object Browser)

TCP » 184.168.221.56:80
3d8a4763-2a81-4784-8f04-7f4227a2f40c-7.exe.66776.gzquar (TheTorntv V10 by esc)

TCP » 184.168.221.56:80
pricora 12.0-codedownloader.exe (Pricora 12.0 by Corporate Inc)

TCP » 184.168.221.56:80
c37af138-5101-4b3d-b0a8-9f637d3b9ced-2.exe (HD-V1.9 by InfoHD-V1.8)

TCP » 184.168.221.56:80
e659c2f6-b592-4eb3-89e8-8b6d7e4656ed-5.exe (Object Browser)

TCP » 184.168.221.56:80
dff83d61-5151-41c1-b783-6aa45d3ed0ce-4.exe (iWebar)

TCP » 184.168.221.56:80
498873fb-c19a-450b-bf44-4155f22eff4e-7.exe (Browsers Apps by app)

TCP » 184.168.221.56:80
c2c330c9-2d35-4ede-9821-e1953d67d3b7-5.exe (TheTorntv V10 by esc)

TCP » 184.168.221.56:80
plus-hd-9.1-novainstaller.exe (Plus-HD-9.1 by Plus HD)

TCP » 184.168.221.56:80
hq-video-pro-1.9-novainstaller.exe (HQ-Video-Pro-1.9 by HQ-Video)

TCP » 184.168.221.56:80
8c2e1496-60b7-4063-bbda-6139ce38d228-4.exe (TheGoPhoto.it V10 by joep)

TCP » 184.168.221.56:80
internet speed checker-codedownloader.exe (Internet Speed Checker by Speedchecker)

TCP » 184.168.221.56:80
firefoxuninstaller63311.exe (TheTorntv V10 by esc)

TCP » 184.168.221.56:80
0d7c9ef9-c70e-4b1a-baad-f0c176458ea1-11.exe (Internet Speed Checker by Speedchecker)

TCP » 184.168.221.56:80
4bd3ec58-c42f-443e-8edb-0a5b2d035380-4.exe (iWebar)

TCP » 184.168.221.56:80
e61ae902-cc88-4c95-9312-ccad5e2bbc57-4.exe (SmartSaver+ 15 by smart-saverplus)

 
Latest 20 of 125 files

URL:
http://www.yomtovoko.info/

Title:
“yomtovoko.info”

Web server:
Apache

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.