home

djx67m9am3a7m.cloudfront.net

Amazon.com, Inc

Domain Information

The domain djx67m9am3a7m.cloudfront.net registered by Amazon.com, Inc was initially registered in April of 2008 through MARKMONITOR INC.. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Seattle, Washington within the United States. The domain uses the Amazon Cloudfront CDN service which utilizes a number of proxy IP Addresses (see below).
Registrar:
MARKMONITOR INC.

Server location:
Washington, United States (US)

Create date:
Friday, April 25, 2008

Expires date:
Tuesday, April 25, 2017

Updated date:
Tuesday, February 25, 2014

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
cloudfront.net

Whois:
1 cloudfront.net record

Scanner detections:
Detections  (69% detected)

Scan engine
Details
Detections

ESET NOD32
MSIL/Adware.Imali.C application, Win32/Virut.NBP virus, Win32/Ramnit.H virus
58.33%

Emsisoft Anti-Malware
Gen:Variant.Adware.Kazy.787022, Gen:Variant.Kazy.790741, Gen:Variant.Adware.Razy.7762, Win32.Virtob.Gen.12, Win32.Ramnit.N
50.00%

F-Secure
Application:W32/Generic.70053c248f!Online, Variant.Adware.Kazy, Variant.Adware.Razy, Win32.Virtob.Gen.12
33.33%

Reason Heuristics
Threat.Win.Reputation.IMP, Adware.Imali
33.33%

Dr.Web
Trojan.Crossrider1.56691, Win32.Virut.56, Trojan.DownLoader18.55205, Trojan.Crossrider1.58013
33.33%

Microsoft Security Essentials
Worm:Win32/NeksMiner.A, Threat.Undefined
25.00%

Kaspersky
not-a-virus:AdWare.MSIL.Agent, Virus.Win32.Virut, Virus.Win32.Nimnul
25.00%

Norman
Gen:Variant.Adware.Kazy.787022, Gen:Variant.Adware.Razy.7762, Win32.Virtob.Gen.12
25.00%

avast!
Win32:Virtu-A, Win32:RmnDrp, Win32:Adware-gen [Adw]
25.00%

MicroWorld eScan
Gen:Variant.Adware.Kazy.787022, Gen:Variant.Kazy.790741
16.67%

Arcabit
Trojan.Adware.Kazy.DC024E, Trojan.Kazy.DC10D5
16.67%

Bitdefender
Gen:Variant.Adware.Kazy.787022, Gen:Variant.Kazy.790741
16.67%

SUPERAntiSpyware
Adware.Kazy/Variant
16.67%

Lavasoft Ad-Aware
Gen:Variant.Adware.Kazy.787022, Gen:Variant.Kazy.790741
16.67%

F-Secure
Gen:Variant.Adware.Kazy, Gen:Variant.Kazy.790741
16.67%

The domain djx67m9am3a7m.cloudfront.net has been seen to resolve to the following 56 IP addresses.

52.85.131.176
server-52-85-131-176.iad53.r.cloudfront.net
July 23, 2016

52.85.131.172
server-52-85-131-172.iad53.r.cloudfront.net
July 23, 2016

52.85.131.127
server-52-85-131-127.iad53.r.cloudfront.net
July 23, 2016

52.85.131.103
server-52-85-131-103.iad53.r.cloudfront.net
July 23, 2016

52.85.131.40
server-52-85-131-40.iad53.r.cloudfront.net
July 23, 2016

52.85.131.27
server-52-85-131-27.iad53.r.cloudfront.net
July 23, 2016

52.85.131.236
server-52-85-131-236.iad53.r.cloudfront.net
July 23, 2016

52.85.131.216
server-52-85-131-216.iad53.r.cloudfront.net
July 23, 2016

52.85.142.131
server-52-85-142-131.iad12.r.cloudfront.net
May 16, 2016

52.85.142.242
server-52-85-142-242.iad12.r.cloudfront.net
May 16, 2016

52.85.142.239
server-52-85-142-239.iad12.r.cloudfront.net
May 16, 2016

52.85.142.224
server-52-85-142-224.iad12.r.cloudfront.net
May 16, 2016

52.85.142.185
server-52-85-142-185.iad12.r.cloudfront.net
May 16, 2016

52.85.142.150
server-52-85-142-150.iad12.r.cloudfront.net
May 16, 2016

52.85.142.110
server-52-85-142-110.iad12.r.cloudfront.net
April 21, 2016

52.85.142.92
server-52-85-142-92.iad12.r.cloudfront.net
April 21, 2016

52.85.142.40
server-52-85-142-40.iad12.r.cloudfront.net
April 21, 2016

52.85.142.240
server-52-85-142-240.iad12.r.cloudfront.net
April 21, 2016

52.85.142.235
server-52-85-142-235.iad12.r.cloudfront.net
April 21, 2016

52.85.142.230
server-52-85-142-230.iad12.r.cloudfront.net
April 21, 2016

52.85.142.139
server-52-85-142-139.iad12.r.cloudfront.net
April 21, 2016

52.85.142.122
server-52-85-142-122.iad12.r.cloudfront.net
April 21, 2016

52.85.131.212
server-52-85-131-212.iad53.r.cloudfront.net
April 19, 2016

52.85.131.169
server-52-85-131-169.iad53.r.cloudfront.net
April 19, 2016

52.85.131.153
server-52-85-131-153.iad53.r.cloudfront.net
April 19, 2016

52.85.131.139
server-52-85-131-139.iad53.r.cloudfront.net
April 19, 2016

52.85.131.96
server-52-85-131-96.iad53.r.cloudfront.net
April 19, 2016

52.85.131.82
server-52-85-131-82.iad53.r.cloudfront.net
April 19, 2016

52.85.131.80
server-52-85-131-80.iad53.r.cloudfront.net
April 19, 2016

52.85.131.221
server-52-85-131-221.iad53.r.cloudfront.net
April 19, 2016

 
Showing 30 of 56 IP Addresses

File downloads found at URLs served by djx67m9am3a7m.cloudfront.net.

3 / 68      (PUP)
http://djx67m9am3a7m.cloudfront.net/SilentInstaller_dotnet4.exe  (hib8f15.exe)

1 / 68      (PUP)
http://djx67m9am3a7m.cloudfront.net/prepreinstaller_win.exe  (7f01.tmp)

2 / 68      (false positives)
http://djx67m9am3a7m.cloudfront.net/SilentInstaller_dotnet4.exe  (wrar420.exe)

9 / 68      (Malware)
http://djx67m9am3a7m.cloudfront.net/prepreinstaller_win.exe  (6d982f333d88d1cf2679591e8d6d24aa)

1 / 68      (Malware)
http://djx67m9am3a7m.cloudfront.net/prepreinstaller_win.exe  (voeg82lhc.exe)

0 / 68
http://djx67m9am3a7m.cloudfront.net/SilentInstaller_dotnet4.exe  (avg222f.exe)

4 / 68      (PUP)
http://djx67m9am3a7m.cloudfront.net/SilentInstaller_dotnet4.exe  (avgcfaf.exe)

4 / 68      (PUP)
http://djx67m9am3a7m.cloudfront.net/SilentInstaller_dotnet4.exe  (hib546.exe)

1 / 68      (Malware)
http://djx67m9am3a7m.cloudfront.net/prepreinstaller_win.exe  (868f7f560bb36f328fea169abe2d8f22)

14 / 68    (Malware)
http://djx67m9am3a7m.cloudfront.net/SilentInstaller_dotnet2.exe  (509a8984c6f4b2a8908214d7a56c8466)

0 / 68
http://djx67m9am3a7m.cloudfront.net/prepreinstaller_win.exe  (log4net.dll)

0 / 68
http://djx67m9am3a7m.cloudfront.net/SilentInstaller_dotnet4.exe  (pacplin.dll)

0 / 68
http://djx67m9am3a7m.cloudfront.net/SilentInstaller_dotnet4.exe  (avg536c.exe)

15 / 68    (PUP)
http://djx67m9am3a7m.cloudfront.net/SilentInstaller_dotnet2.exe  (d02daa5a1f94dcfd85608511eeb5aacc)

1 / 68      (Malware)
http://djx67m9am3a7m.cloudfront.net/prepreinstaller_win.exe  (09024b18a198fa1d154751ff28afed8c)

15 / 68    (PUP)
http://djx67m9am3a7m.cloudfront.net/SilentInstaller_dotnet4.exe  (8439b4a33cccce306dd5ba1698ff6151)

The following 36 files have been seen to comunicate with djx67m9am3a7m.cloudfront.net in live environments.

TCP » 54.192.195.204:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 54.192.195.78:443
online-guardian-v2.0.9.exe

TCP » 54.192.195.204:443
online-guardian-v2.0.9.exe

TCP » 52.85.142.224:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 54.192.195.78:443
apptrailers.exe

TCP » 52.85.142.110:80
jingling.exe

TCP » 54.192.195.78:443
apptrailers.exe

TCP » 52.85.142.235:443
stormwatchapp.exe

TCP » 52.85.142.185:443
UCBrowser.exe (by UCWeb)

TCP » 52.85.142.40:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.85.142.131:443
citrio.exe (Citrio by CatalinaGroup)

TCP » 54.192.195.26:443
onlineguardian-v2.exe

TCP » 52.85.142.110:80
new_chrome.exe (1stBrowser by The 1stBrowser Authors)

TCP » 52.85.142.110:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.85.142.92:443
online-guardian-v2.0.9.exe

TCP » 54.192.195.204:443
apptrailers.exe

TCP » 52.85.142.131:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.85.142.139:80
mobogenieP2sp.exe (mobogenie by mobogenie.com)

TCP » 52.85.142.122:443
new_chrome.exe (1stBrowser by The 1stBrowser Authors)

TCP » 52.85.142.185:80
browser.exe (speed browser by Smart Applications)

 
Latest 20 of 86 files

URL:
http://djx67m9am3a7m.cloudfront.net/

Network:
Amazon Cloudfront

SSL certificate subject:
CN=*.cloudfront.net, O="Amazon.com, Inc.", L=Seattle, S=Washington, C=US

SSL certificate issuer:
CN=Symantec Class 3 Secure Server CA - G4, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Web server:
AmazonS3

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.