cdn.filebulldog.com

Somoto Ltd.  (via a Proxy Registrant)

Domain Information

The domain cdn.filebulldog.com is registered by proxy through GODADDY.COM, LLC and was originally registered in August of 2010. This domain has been known to host and distribute potentially unwanted software. The hosted servers are located in Seattle, Washington within the United States. The domain uses the Amazon Cloudfront CDN service which utilizes a number of proxy IP Addresses (see below). The domain is associated with the publisher Somoto Ltd. who is located in Tel Aviv, Israel.
Registrar:
GODADDY.COM, LLC

Server location:
Washington, United States (US)

Create date:
Sunday, August 8, 2010

Expires date:
Tuesday, August 8, 2017

Updated date:
Sunday, August 9, 2015

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Sophos
Somoto BetterInstaller
100.00%

Dr.Web
Adware.Somoto.4, Adware.Somoto.8
100.00%

ESET NOD32
Win32/Somoto, Win32/Somoto (variant)
100.00%

Fortinet FortiGate
Adware/Toolbar, Riskware/Somoto
100.00%

Malwarebytes
PUP.Optional.Somoto.A
100.00%

Reason Heuristics
PUP.Installer.Somoto.N
100.00%

NANO AntiVirus
Trojan.Win32.Agent.cruvhh, Trojan.Win32.Somoto.cumknu
100.00%

Boost by Reason
Trojan.Adw.Installer.Somoto.N
50.00%

nProtect
Trojan/W32.Agent.141216
50.00%

F-Prot
W32/SomotoBetterInstaller.A
50.00%

Trend Micro House Call
ADW_SOMOTO
50.00%

avast!
Win32:Somoto-F [PUP]
50.00%

Clam AntiVirus
Win.Adware.Toolbar-1
50.00%

Trend Micro
ADW_SOMOTO
50.00%

Bkav FE
W32.Clod191.Trojan
50.00%

The domain cdn.filebulldog.com has been seen to resolve to the following 16 IP addresses.

server-52-84-125-115.iad16.r.cloudfront.net
August 22, 2016

server-52-84-125-112.iad16.r.cloudfront.net
August 22, 2016

server-52-84-125-100.iad16.r.cloudfront.net
August 22, 2016

server-52-84-125-27.iad16.r.cloudfront.net
August 22, 2016

server-52-84-125-214.iad16.r.cloudfront.net
August 22, 2016

server-52-84-125-198.iad16.r.cloudfront.net
August 22, 2016

server-52-84-125-147.iad16.r.cloudfront.net
August 22, 2016

server-52-84-125-126.iad16.r.cloudfront.net
August 22, 2016

server-54-192-195-139.iad53.r.cloudfront.net
February 10, 2016

server-54-192-195-92.iad53.r.cloudfront.net
February 10, 2016

server-54-192-195-80.iad53.r.cloudfront.net
February 10, 2016

server-54-192-195-21.iad53.r.cloudfront.net
February 10, 2016

server-54-192-195-246.iad53.r.cloudfront.net
February 10, 2016

server-54-192-195-224.iad53.r.cloudfront.net
February 10, 2016

server-54-192-195-202.iad53.r.cloudfront.net
February 10, 2016

server-54-192-195-182.iad53.r.cloudfront.net
February 10, 2016

File downloads found at URLs served by cdn.filebulldog.com.

10 / 68    (Adware)

17 / 68    (Adware)
http://cdn.filebulldog.com/.../bi_downloader.exe  (9b62c7540bfc4a4a68b2d7a20ee13af5)

The following 17 files have been seen to comunicate with cdn.filebulldog.com in live environments.

URL:
http://cdn.filebulldog.com/

Network:
Amazon Cloudfront

Web server:
nginx