yz0fi.voluumtrk.com

CodeWise spolka z ograniczona odpowiedzialnoscia sp. k.

Domain Information

The domain yz0fi.voluumtrk.com registered by CodeWise spolka z ograniczona odpowiedzialnoscia sp. k. was initially registered in August of 2014 through DYNADOT, LLC. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Ashburn, Virginia within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform.
Registrar:
DYNADOT, LLC

Server location:
Virginia, United States (US)

Create date:
Wednesday, August 6, 2014

Expires date:
Thursday, August 6, 2015

Updated date:
Monday, September 22, 2014

ASN:
AS14618 AMAZON-AES - Amazon.com, Inc.,US

Root domain:

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

ESET NOD32
Win32/OutBrowse.BS potentially unwanted application, Win32/OutBrowse.BT potentially unwanted application, Win32/OutBrowse.BU potentially unwanted application
100.00%

K7 AntiVirus
Trojan , Unwanted-Program , DoS-Trojan
100.00%

Avira AntiVirus
APPL/Outbrowse.Gen, APPL/Downloader.Gen, TR/Trash.Gen, PUA/Outbrowse.Gen
100.00%

AVG
Downloader, Potentially harmful program Downloader.DGR, Potentially harmful program Downloader.DGI, Potentially harmful program Downloader.DEI
100.00%

Reason Heuristics
PUP.STARTnow, PUP.Outborwse, PUP.Outbrowse, PUP.Installer.Outborwse
92.86%

Malwarebytes
PUP.Optional.OutBrowse, PUP.Optional.OutBrowse.gen
92.86%

Trend Micro House Call
Suspici.D13D3815, Suspici.1AC582C8, Suspici.83CCD372, Suspici.D88B743E, Suspici.B3BC0FA9, Suspici.84A1176B, Suspici.43C49BDD
92.86%

Dr.Web
Trojan.OutBrowse.59, Trojan.OutBrowse.81, Trojan.OutBrowse.68, Trojan.OutBrowse.78, infected with Trojan.OutBrowse.96
92.86%

VIPRE Antivirus
Threat.4823950, Threat.4150696, Threat.204214
85.71%

Kaspersky
not-a-virus:Downloader.NSIS.OutBrowse
85.71%

McAfee
Adware-OutBrowse.e, Program.Adware-OutBrowse.e
85.71%

Fortinet FortiGate
Riskware/OutBrowse
85.71%

Lavasoft Ad-Aware
MemScan:Application.Bundler.JU, Dropped:Application.Bundler.Outbrowse.AJ, Dropped:Trojan.Generic.12644885, Gen:Variant.Application.Bundler.Outbrowse.1
78.57%

NANO AntiVirus
Trojan.Win32.OutBrowse.dmxjlz, Trojan.Win32.OutBrowse.dmzljb, Trojan.Win32.OutBrowse.dnkyzt, Trojan.Win32.OutBrowse.dnberq
78.57%

Emsisoft Anti-Malware
MemScan:Application.Bundler.JU, Dropped:Application.Bundler.Outbrowse.AJ, Gen:Variant.Application.Bundler.Outbrowse
71.43%

The domain yz0fi.voluumtrk.com has been seen to resolve to the following 2 IP addresses.

ec2-54-174-214-114.compute-1.amazonaws.com
May 4, 2015

ec2-54-86-175-7.compute-1.amazonaws.com
May 4, 2015

File downloads found at URLs served by yz0fi.voluumtrk.com.

URL:
http://yz0fi.voluumtrk.com/

Network:
Amazon Web Services (AWS), running an EC2 instance

SSL certificate subject:
CN=*.voluumtrk.com, O=Codewise sp. z o.o. sp. k., L=Krakow, C=PL

SSL certificate issuer:
CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US

Web server:
Voluum-Traffic/1.0