home

d3dle8xo1zpfnz.cloudfront.net

Amazon.com, Inc

Domain Information

The domain d3dle8xo1zpfnz.cloudfront.net registered by Amazon.com, Inc was initially registered in April of 2008 through MARKMONITOR INC.. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Dulles, Virginia within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Cloudfront CDN service which utilizes a number of proxy IP Addresses (see below).
Registrar:
MARKMONITOR INC.

Server location:
Virginia, United States (US)

Create date:
Friday, April 25, 2008

Expires date:
Tuesday, April 25, 2017

Updated date:
Tuesday, February 25, 2014

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
cloudfront.net

Whois:
1 cloudfront.net record

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

VIPRE Antivirus
Goobzo
100.00%

ESET NOD32
Win32/SpeedBit (variant)
100.00%

Reason Heuristics
PUP.Goobzo.S, PUP.Installer.Goobzo.F, PUP.Goobzo.F, PUP.Goobzo.M
100.00%

Baidu Antivirus
Adware.Win32.SpeedBit, Adware.Win32.CrossAd
100.00%

AVG
Skodna
100.00%

G Data
Trojan.Generic.11488800, Gen:Variant.Strictor.62444, Win32.Application.Shopperpro
100.00%

IKARUS anti.virus
AdWare.CrossRider, PUA.OptionalInst.Goobzo, PUA.Goobzo
80.00%

Panda Antivirus
Trj/CI.A, Adware/Goobzo
80.00%

McAfee
Artemis!0D53800BECE7, Artemis!10D2D1AA0681
60.00%

Trend Micro House Call
Suspicious_GEN.F47V0625, Suspicious_GEN.F47V0714
60.00%

MicroWorld eScan
Trojan.Generic.11488800, Gen:Variant.Strictor.62444
60.00%

K7 AntiVirus
Trojan , Unwanted-Program
60.00%

Bitdefender
Trojan.Generic.11488800, Gen:Variant.Strictor.62444
60.00%

Lavasoft Ad-Aware
Trojan.Generic.11488800, Gen:Variant.Strictor.62444
60.00%

F-Secure
Trojan.Generic.11488800, Gen:Variant.Strictor.62444
60.00%

The domain d3dle8xo1zpfnz.cloudfront.net has been seen to resolve to the following 114 IP addresses.

52.85.131.247
server-52-85-131-247.iad53.r.cloudfront.net
April 7, 2016

52.85.131.241
server-52-85-131-241.iad53.r.cloudfront.net
April 7, 2016

52.85.131.208
server-52-85-131-208.iad53.r.cloudfront.net
April 7, 2016

52.85.131.144
server-52-85-131-144.iad53.r.cloudfront.net
April 7, 2016

52.85.131.73
server-52-85-131-73.iad53.r.cloudfront.net
April 7, 2016

52.85.131.62
server-52-85-131-62.iad53.r.cloudfront.net
April 7, 2016

52.85.131.51
server-52-85-131-51.iad53.r.cloudfront.net
April 7, 2016

52.85.131.28
server-52-85-131-28.iad53.r.cloudfront.net
April 7, 2016

54.230.39.207
server-54-230-39-207.jfk1.r.cloudfront.net
May 4, 2015

54.192.37.85
server-54-192-37-85.jfk1.r.cloudfront.net
May 4, 2015

54.230.36.221
server-54-230-36-221.jfk1.r.cloudfront.net
May 4, 2015

54.230.38.219
server-54-230-38-219.jfk1.r.cloudfront.net
May 4, 2015

54.192.36.76
server-54-192-36-76.jfk1.r.cloudfront.net
May 4, 2015

54.230.38.147
server-54-230-38-147.jfk1.r.cloudfront.net
May 4, 2015

204.246.169.97
server-204-246-169-97.jfk1.r.cloudfront.net
May 4, 2015

54.230.38.169
server-54-230-38-169.jfk1.r.cloudfront.net
May 4, 2015

54.192.54.82
server-54-192-54-82.jfk6.r.cloudfront.net
May 3, 2015

54.192.55.14
server-54-192-55-14.jfk6.r.cloudfront.net
May 3, 2015

54.192.55.203
server-54-192-55-203.jfk6.r.cloudfront.net
May 3, 2015

54.192.54.174
server-54-192-54-174.jfk6.r.cloudfront.net
May 3, 2015

54.230.55.58
server-54-230-55-58.jfk6.r.cloudfront.net
May 3, 2015

54.192.55.158
server-54-192-55-158.jfk6.r.cloudfront.net
May 3, 2015

54.192.55.23
server-54-192-55-23.jfk6.r.cloudfront.net
May 3, 2015

54.192.55.21
server-54-192-55-21.jfk6.r.cloudfront.net
May 3, 2015

54.230.102.139
server-54-230-102-139.iad2.r.cloudfront.net
January 14, 2015

54.192.101.68
server-54-192-101-68.iad2.r.cloudfront.net
January 14, 2015

54.230.16.159
server-54-230-16-159.iad12.r.cloudfront.net
January 3, 2015

54.230.16.11
server-54-230-16-11.iad12.r.cloudfront.net
January 3, 2015

54.240.160.233
server-54-240-160-233.iad12.r.cloudfront.net
January 3, 2015

54.240.160.88
server-54-240-160-88.iad12.r.cloudfront.net
January 3, 2015

 
Showing 30 of 114 IP Addresses

File downloads found at URLs served by d3dle8xo1zpfnz.cloudfront.net.

17 / 68    (Adware)
http://d3dle8xo1zpfnz.cloudfront.net/.../ytai_ytareg_setup.exe  (ins_postinst.exe)

8 / 68      (Adware)
https://d3dle8xo1zpfnz.cloudfront.net/.../ytai_fc2386f755_setup.exe  (delay.exe)

9 / 68      (Adware)
http://d3dle8xo1zpfnz.cloudfront.net/.../ytai_ytareg_setup.exe  (delay.exe)

8 / 68      (Adware)
https://d3dle8xo1zpfnz.cloudfront.net/.../ytai_0b482963b2_setup.exe  (delay.exe)

28 / 68    (Adware)
https://d3dle8xo1zpfnz.cloudfront.net/.../ytai_729908846c_setup.exe  (10d2d1aa06814c3f45375601ad0de708)

8 / 68      (Adware)
https://d3dle8xo1zpfnz.cloudfront.net/.../ytai_f1d528697d_setup.exe  (delay.exe)

8 / 68      (Adware)
https://d3dle8xo1zpfnz.cloudfront.net/.../ytai_9409762dbc_setup.exe  (delay.exe)

28 / 68    (Adware)
https://d3dle8xo1zpfnz.cloudfront.net/.../ytai_3fd9b39f59_setup.exe  (10d2d1aa06814c3f45375601ad0de708)

8 / 68      (Adware)
https://d3dle8xo1zpfnz.cloudfront.net/.../ytai_e99b9443e4_setup.exe  (delay.exe)

8 / 68      (Adware)
https://d3dle8xo1zpfnz.cloudfront.net/.../ytai_82145a1601_setup.exe  (delay.exe)

8 / 68      (Adware)
https://d3dle8xo1zpfnz.cloudfront.net/.../ytai_daf6a23562_setup.exe  (delay.exe)

8 / 68      (Adware)
https://d3dle8xo1zpfnz.cloudfront.net/.../ytai_312922372c_setup.exe  (delay.exe)

8 / 68      (Adware)
https://d3dle8xo1zpfnz.cloudfront.net/.../ytai_ef05cb535f_setup.exe  (delay.exe)

28 / 68    (Adware)
https://d3dle8xo1zpfnz.cloudfront.net/.../ytai_6178fedec7_setup.exe  (10d2d1aa06814c3f45375601ad0de708)

28 / 68    (Adware)
https://d3dle8xo1zpfnz.cloudfront.net/.../ytai_4749256e04_setup.exe  (10d2d1aa06814c3f45375601ad0de708)

8 / 68      (Adware)
http://d3dle8xo1zpfnz.cloudfront.net/.../ytai_ytareg_setup.exe  (delay.exe)

8 / 68      (Adware)
https://d3dle8xo1zpfnz.cloudfront.net/.../ytai_58c6f7782b_setup.exe  (delay.exe)

22 / 68    (Adware)
https://d3dle8xo1zpfnz.cloudfront.net/.../ytai_a864dc7f21_setup.exe  (youtubeaccelerator.exe)

The following 133 files have been seen to comunicate with d3dle8xo1zpfnz.cloudfront.net in live environments.

TCP » 54.192.37.85:80
browser.exe (Browser)

TCP » 54.230.193.137:443
online-guardian-v2.0.9.exe

TCP » 54.192.36.76:80
winsaber.exe

TCP » 54.192.55.203:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 54.230.51.67:443
browserairexec.exe (BrowserAir by Goobzo)

TCP » 54.192.37.85:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 54.230.193.137:443
online-guardian-v2.0.9.exe

TCP » 54.230.51.67:80
interhop.exe

TCP » 54.192.55.158:80
1f84cbaf-c4d3-422f-9e74-5a5092dcd920-10.exe (CinemaP-1.9cV17.02 by Cinema PlusV17.02)

TCP » 54.192.55.14:80
britches.exe (Britches)

TCP » 54.192.36.76:80
saber.exe

TCP » 54.192.37.85:80
winzipersvc.exe (ExHelp by ExWzp Pvt)

TCP » 54.230.50.162:443
citrio.exe (Citrio by CatalinaGroup)

TCP » 54.230.51.67:80
mine-craft-setup.exe

TCP » 54.192.55.203:80
interhop.exe

TCP » 54.192.55.23:443
online-guardian-v2.0.9.exe

TCP » 54.192.55.21:80
tsvr.exe (Trend Service by Trend)

TCP » 54.192.37.85:80
wfini.exe (Trend Service by Trend)

TCP » 54.192.55.23:443
online-guardian-v2.0.9.exe

TCP » 54.192.55.203:80
sosoim4.exe

 
Latest 20 of 184 files

URL:
http://d3dle8xo1zpfnz.cloudfront.net/

Network:
Amazon Cloudfront

SSL certificate subject:
CN=*.cloudfront.net, O="Amazon.com, Inc.", L=Seattle, S=Washington, C=US

SSL certificate issuer:
CN=Symantec Class 3 Secure Server CA - G4, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Web server:
Microsoft-IIS/7.5 (ASP.NET)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.