home

cdn4.continuumdownload.com

Moniker Privacy Services  (Proxy Registrant)

Domain Information

The domain cdn4.continuumdownload.com is registered by proxy through Moniker Online Services and was originally registered in October of 2013. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Dulles, Virginia within the United States. The domain uses the Amazon Cloudfront CDN service which utilizes a number of proxy IP Addresses (see below).
Registrar:
Moniker Online Services

Server location:
Virginia, United States (US)

Create date:
Thursday, October 31, 2013

Expires date:
Monday, October 31, 2016

Updated date:
Wednesday, December 16, 2015

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc., US

Root domain:
continuumdownload.com

Whois:
1 continuumdownload.com record

Google Safe Browsing:
unwanted

Scanner detections:
Detections  (96% detected)

Scan engine
Details
Detections

Reason Heuristics
Threat.Win.Reputation.IMP, Adware.Amonetize.Reflecti.Meta (M), Adware.Amonetize.ET (M), Adware.Amonetize.RiseAgai.Meta (M), Adware.Amonetize.StLouisB.Meta (M), Adware.Amonetize.Tool.Meta (M), Adware.Amonetize.Lateralu.Meta (M), Adware.Amonetize.MailRU.Meta (M), Adware.Amonetize.Clondayc.Meta (M), Adware.Amonetize.TuesdayG.Meta (M), Adware.Amonetize.TJSoluti.Meta (M), PUP.Amonitize, Adware.Amonetize.PrefferH.Meta (M), Adware.Amonetize.HouseSol.Meta (M), Adware.Amonetize (M), Adware.Amonetize.BlueWorm.Meta (M), Adware.Amonetize.Needfull.Meta (M), Adware.Amonetize.January.Meta (M)
91.84%

ESET NOD32
Win32/Amonetize.VF potentially unwanted application, Win32/Amonetize.TJ potentially unwanted application, Win32/Amonetize.WC potentially unwanted application, Win32/Amonetize.WX potentially unwanted application, Win32/Amonetize.RG potentially unwanted application, Win32/Amonetize.UX potentially unwanted application, Win32/Amonetize.VR potentially unwanted application, Win32/Neshta.A virus, Win32/Amonetize.NY potentially unwanted application
38.78%

Kaspersky
not-a-virus:HEUR:AdWare.Win32.Amonetize, not-a-virus:AdWare.Win32.Amonetize, not-a-virus:Downloader.Win32.AdLoad, Virus.Win32.Neshta
24.49%

Emsisoft Anti-Malware
Gen:Variant.Strictor.109735, Gen:Variant.Strictor.109808, Trojan.GenericKD.3398906
6.12%

Dr.Web
Adware.Downware.15874, Win32.HLLP.Neshta, Adware.Downware.16038
6.12%

avast!
Win32:Malware-gen, Win32:Apanas [Trj]
4.08%

Norman
Gen:Variant.Jaik.11506, Gen:Variant.Symmi.64121
4.08%

Microsoft Security Essentials
Threat.Undefined
2.04%

The domain cdn4.continuumdownload.com has been seen to resolve to the following 119 IP addresses.

54.230.193.107
server-54-230-193-107.iad53.r.cloudfront.net
August 27, 2016

54.230.193.104
server-54-230-193-104.iad53.r.cloudfront.net
August 27, 2016

54.230.193.56
server-54-230-193-56.iad53.r.cloudfront.net
August 27, 2016

54.230.193.31
server-54-230-193-31.iad53.r.cloudfront.net
August 27, 2016

54.230.193.223
server-54-230-193-223.iad53.r.cloudfront.net
August 27, 2016

54.230.193.207
server-54-230-193-207.iad53.r.cloudfront.net
August 27, 2016

54.230.193.160
server-54-230-193-160.iad53.r.cloudfront.net
August 27, 2016

54.230.193.145
server-54-230-193-145.iad53.r.cloudfront.net
August 27, 2016

54.192.19.193
server-54-192-19-193.iad12.r.cloudfront.net
August 26, 2016

54.192.19.129
server-54-192-19-129.iad12.r.cloudfront.net
August 26, 2016

54.192.19.81
server-54-192-19-81.iad12.r.cloudfront.net
August 26, 2016

54.192.19.68
server-54-192-19-68.iad12.r.cloudfront.net
August 26, 2016

54.192.19.20
server-54-192-19-20.iad12.r.cloudfront.net
August 26, 2016

54.192.19.6
server-54-192-19-6.iad12.r.cloudfront.net
August 26, 2016

54.192.19.247
server-54-192-19-247.iad12.r.cloudfront.net
August 26, 2016

52.84.125.128
server-52-84-125-128.iad16.r.cloudfront.net
August 26, 2016

52.84.125.109
server-52-84-125-109.iad16.r.cloudfront.net
August 26, 2016

54.230.192.134
server-54-230-192-134.iad53.r.cloudfront.net
August 24, 2016

54.230.192.114
server-54-230-192-114.iad53.r.cloudfront.net
August 24, 2016

54.230.192.87
server-54-230-192-87.iad53.r.cloudfront.net
August 24, 2016

54.230.192.25
server-54-230-192-25.iad53.r.cloudfront.net
August 24, 2016

54.230.192.233
server-54-230-192-233.iad53.r.cloudfront.net
August 24, 2016

54.230.192.215
server-54-230-192-215.iad53.r.cloudfront.net
August 24, 2016

54.230.192.203
server-54-230-192-203.iad53.r.cloudfront.net
August 24, 2016

54.230.192.176
server-54-230-192-176.iad53.r.cloudfront.net
August 24, 2016

52.84.125.249
server-52-84-125-249.iad16.r.cloudfront.net
August 23, 2016

52.84.125.203
server-52-84-125-203.iad16.r.cloudfront.net
August 22, 2016

52.84.125.180
server-52-84-125-180.iad16.r.cloudfront.net
August 22, 2016

52.84.125.159
server-52-84-125-159.iad16.r.cloudfront.net
August 22, 2016

52.84.125.150
server-52-84-125-150.iad16.r.cloudfront.net
August 22, 2016

 
Showing 30 of 119 IP Addresses

File downloads found at URLs served by cdn4.continuumdownload.com.

5 / 68      (Malware)
http://cdn4.continuumdownload.com/.../Bundle.exe  (b072.tmp.exe)

The following 358 files have been seen to comunicate with cdn4.continuumdownload.com in live environments.

TCP » 52.84.125.141:443
Client.exe

TCP » 54.192.19.176:80
jingling.exe

TCP » 54.230.192.203:443
citrio.exe (Citrio by CatalinaGroup)

TCP » 54.192.19.132:443
new_chrome.exe (1stBrowser by The 1stBrowser Authors)

TCP » 54.192.19.180:80
browser.exe (Browser)

TCP » 54.192.19.244:443
1stbrowser.exe (1stBrowser by The 1stBrowser Authors)

TCP » 54.192.19.166:443
online-guardian-v2.0.9.exe

TCP » 52.84.125.146:443
browserairexec.exe (BrowserAir by Goobzo)

TCP » 54.192.19.77:80
saber.exe

TCP » 54.192.19.70:443
1stbrowser.exe (1stBrowser by The 1stBrowser Authors)

TCP » 52.84.125.203:443
strummer.exe (Strummer)

TCP » 54.192.19.40:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 54.192.19.77:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 54.192.19.33:80
saber.exe

TCP » 52.84.125.125:80
se.exe

TCP » 54.192.19.166:80
spassist.exe (SoftPlanet Software Assistant by Secure Download)

TCP » 54.192.19.228:80
uvconverter.exe (TODO: <Product name> by TODO: <Company name>)

TCP » 52.85.142.233:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 54.192.19.136:80
parishoners.exe (Parishoners)

TCP » 54.192.19.239:80
saber.exe

 
Latest 20 of 874 files

URL:
http://cdn4.continuumdownload.com/

Network:
Amazon Cloudfront

Web server:
AmazonS3

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.