home

coolpdfreader.com

Privacy Protection Service INC d/b/a PrivacyProtect.org  (Proxy Registrant)

Domain Information

The domain coolpdfreader.com is registered by proxy through PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM and was originally registered in February of 2012. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Ashburn, Virginia within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform.
Registrar:
PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM

Server location:
Virginia, United States (US)

Create date:
Wednesday, February 22, 2012

Expires date:
Wednesday, February 22, 2017

Updated date:
Monday, January 25, 2016

ASN:
AS14618 AMAZON-AES - Amazon.com, Inc.,US

Whois:
3 coolpdfreader.com records

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.InstallCore.Internet.Installer.Meta (M), PUP.NewMedia.NMH.installCore.Installer (M)
100.00%

The domain coolpdfreader.com has been seen to resolve to the following 10 IP addresses.

52.7.132.182
ec2-52-7-132-182.compute-1.amazonaws.com
August 11, 2015

107.23.203.23
ec2-107-23-203-23.compute-1.amazonaws.com
August 11, 2015

54.84.143.69
ec2-54-84-143-69.compute-1.amazonaws.com
August 11, 2015

54.84.140.114
ec2-54-84-140-114.compute-1.amazonaws.com
June 28, 2015

54.236.147.238
ec2-54-236-147-238.compute-1.amazonaws.com
June 28, 2015

54.209.232.94
ec2-54-209-232-94.compute-1.amazonaws.com
June 28, 2015

184.73.236.207
ec2-184-73-236-207.compute-1.amazonaws.com
March 3, 2014

174.129.244.8
ec2-174-129-244-8.compute-1.amazonaws.com
March 3, 2014

54.243.90.91
ec2-54-243-90-91.compute-1.amazonaws.com
March 3, 2014

23.23.134.198
ec2-23-23-134-198.compute-1.amazonaws.com
March 3, 2014

File downloads found at URLs served by coolpdfreader.com.

1 / 68      (PUP)
http://coolpdfreader.com/?dl=1&pipi=Ajg4NzcyATLFNM==&osos=VdluDrW3cw==&dr=c3aW7mcm2r0Wc32lDXimcHaWck1E dWE rLtDK5y2rgmIT1zvm2yIKiWvmREhKVuvmNjhVxavmNBDz1l QDjhTnmDZ0wvmNpDZ1fATCROZC4AZCRvm5EIKiWXzizNzi1NzAyNZa=&pd=2323UENJDEx37XvlUK2l2kFj d0=&campaignId=9jn0Aj71OTcyAZMq  (googleearthsetup.exe)

1 / 68      (PUP)
http://coolpdfreader.com/?dl=1&pipi=Ajg4NzcyAZgzAw==&osos=VdluDrW3cw==&dr=c3aW7mcm2r0Wc32lDXimcHaWck1JcrVu dDmIKNlvmCWcyDEcmlChSDBDz1mcQDj7z1rLQDj rcWDEam7z0RvmiWAkDjIKiWXzC3AZLyATn0ASDPDdlChV8FNzAyNjMzAT7y&pd=2323Uml0UXvP2rLu7dWt&campaignId=9jn0Aj7dNzgyAZMq  (openofficesetup.exe)

1 / 68      (PUP)
http://coolpdfreader.com/?dl=1&pipi=Ajg4NzcRNZi1OM==&osos=VdluDrW3cw==&dr=cHaWck112rWycmVu2kD0 T1z2dVl2Zamc3aW7mcmIT1zvm2yIKiWvmREhKVzvmNjhLVTvmNBDz1lcyDjhTnmDZ0wvmNpDZ1fNT70NjLzATiRvm5EIKiWXzaRNzcdAjLRAZA=&pd=2323Um2l2k1p EN07KRBUmNJ i==&campaignId=9jn0Aj7dNzgyAZMq  (utorrentsetup.exe)

1 / 68      (Adware)
http://coolpdfreader.com/?dl=1&pipi=Ajg4NzcyAj7yAM==&osos=VdluDrW3cw==&dr=cHaWck1jIHvJ KLm2r0Wc32lDXiyvENyhKvEvmCWcyDEcmlChSDBDz1p2kDj7z1vVkDj rcWIXim7z0RvmiWAkDjIKiWXzLzNZczOZMFASDPDdlChV8wAZaRNjC4ATiy&pd=2323UExJck1EIXDlUmNJ i==&campaignId=9jn0Aj74OZA0AZMq  (googlechromesetup.exe)

1 / 68      (PUP)
http://coolpdfreader.com/?dl=1&pipi=Ajg4NzcyAj7yAM==&osos=VdluDrW3cw==&dr=c3aW7mcm2r0Wc32lDXimcHaWck1E dWE rLtDK5y2rgmIT1zvm2yIKiWvmREhKDyvmNjhLDSvmNBDz1mcQDjhTnmDZ0wvmNpDZ1fOTCROZC4AZCRvm5EIKiWXzMFATcdNzAyNZa=&pd=2323UENJDEx37XvlUK2l2kFj d0=&campaignId=9jn0Aj70NjayAZMq  (googleearthsetup.exe)

The following 3 files have been seen to comunicate with coolpdfreader.com in live environments.

TCP » 54.84.143.69:80
WajamInternetEnhancer.exe (Wajam Internet Enhancer by Wajam Internet Technologies)

TCP » 54.84.143.69:80
notifier64.exe (Notifications)

TCP » 54.84.143.69:80
ContentFinder.exe (ContentFinder by ContentFinder Company)

March 3, 2014
www.coolpdfreader.com

URL:
http://coolpdfreader.com/

Title:
“Thank you page”

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
nginx/1.4.7

Facebook:
Shares:  3

Statistics above are for the previous month of March 2024.

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.