home

dl-2.kbm2.com

Moniker Privacy Services  (Proxy Registrant)

Domain Information

The domain dl-2.kbm2.com is registered by proxy through Moniker Online Services and was originally registered in December of 2011. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Dulles, Virginia within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Cloudfront CDN service which utilizes a number of proxy IP Addresses (see below).
Registrar:
Moniker Online Services

Server location:
Virginia, United States (US)

Create date:
Friday, December 16, 2011

Expires date:
Friday, December 16, 2016

Updated date:
Wednesday, November 19, 2014

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
kbm2.com

Whois:
1 kbm2.com record

Scanner detections:
Detections  (79% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Installer.Yontoo.L, PUP.DealPly.C, PUP.Toolbar.Montera.H, PUP.Optional.JDIBACKUPLIMITED.S, PUP.Webfuii.P, PUP.Amonetizeltd.G, PUP.YolobarInstaller.VisicomMedia.M, PUP.tanzuki.K, PUP.Optional.Installer, Win32.Generic.Installer.Meta, PUP.Covus.Freemium.Bundler (M)
87.50%

Dr.Web
Adware.Plugin.11, Adware.Shopper.348, Adware.Downware.1898, Adware.Shopper.328, Adware.Downware.1659, Adware.Downware.1411
58.33%

Trend Micro House Call
TROJ_GEN.RCBH1ET13, ADW_DEALPLY, TROJ_GEN.F47V0406, TROJ_GEN.F47V0919, TROJ_GEN.F47V0220, TROJ_GEN.F47V0402, TROJ_GEN.R0CBH0AJ113, TROJ_GEN.F47V0114, BKDR_BIFROSE.BMC
50.00%

VIPRE Antivirus
Yontoo, Adware.DealPly, Amonetize, Trojan.Win32.Generic, Elex Installer
45.83%

ESET NOD32
Win32/Toolbar.Alnaddy (variant), Win32/MyPCBackup, Win32/DealPly, Win32/Amonetize (variant), Win32/Adware.Yontoo (variant)
45.83%

Comodo Security
ApplicUnwnt, Application.Win32.DealPly.~BHU, Heur.Suspicious, UnclassifiedMalware
37.50%

avast!
Win32:DealPly-A [PUP], NSIS:Adware-LO [PUP], NSIS:Downloader-AAJ [PUP], Win32:Amonetize-I [PUP], Win32:Crossrider-B [PUP]
33.33%

AVG
AdInject.Yontoo, MalSign.Generic, AdInject.Alactro, Generic_r
29.17%

Baidu Antivirus
Adware.Win32.Agent, Trojan.Win32.DealPly, [08:22:50], Trojan.Win32.StartPage, Trojan.Win32.Adware
25.00%

Avira AntiVirus
ADWARE/Yontoo.Gen, ADWARE/Yontoo.Gen2, ADWARE/Adware.Gen2
20.83%

Rising Antivirus
Trojan.InstallRex!562A, NS:PUF.SilenceInstaller!1.9DDF, PE:Trojan.Win32.Generic.1400B85B!335591515
20.83%

IKARUS anti.virus
AdWare.Yontoo, AndroidOS.AdWare.Mobserv, AdWare.Gen2
20.83%

Agnitum Outpost
Adware.Yontoo, PUA.Amonetize, Trojan.ExqPage
20.83%

McAfee
Artemis!B1A9C17E5529, Artemis!F9CD7F14B752, Artemis!A1DAD7E20CDA, PUP-FDW
20.83%

K7 AntiVirus
Adware, Unwanted-Program
20.83%

The domain dl-2.kbm2.com has been seen to resolve to the following 104 IP addresses.

54.230.193.62
server-54-230-193-62.iad53.r.cloudfront.net
August 26, 2016

54.230.193.243
server-54-230-193-243.iad53.r.cloudfront.net
August 26, 2016

54.230.193.217
server-54-230-193-217.iad53.r.cloudfront.net
August 26, 2016

54.230.193.211
server-54-230-193-211.iad53.r.cloudfront.net
August 26, 2016

54.230.193.152
server-54-230-193-152.iad53.r.cloudfront.net
August 26, 2016

54.230.193.136
server-54-230-193-136.iad53.r.cloudfront.net
August 26, 2016

54.230.193.129
server-54-230-193-129.iad53.r.cloudfront.net
August 26, 2016

54.230.193.94
server-54-230-193-94.iad53.r.cloudfront.net
August 26, 2016

52.84.125.96
server-52-84-125-96.iad16.r.cloudfront.net
July 23, 2016

52.84.125.39
server-52-84-125-39.iad16.r.cloudfront.net
July 23, 2016

52.84.125.37
server-52-84-125-37.iad16.r.cloudfront.net
July 23, 2016

52.84.125.211
server-52-84-125-211.iad16.r.cloudfront.net
July 23, 2016

52.84.125.193
server-52-84-125-193.iad16.r.cloudfront.net
July 23, 2016

52.84.125.186
server-52-84-125-186.iad16.r.cloudfront.net
July 23, 2016

52.84.125.107
server-52-84-125-107.iad16.r.cloudfront.net
July 23, 2016

52.84.125.101
server-52-84-125-101.iad16.r.cloudfront.net
July 23, 2016

52.84.125.31
server-52-84-125-31.iad16.r.cloudfront.net
July 20, 2016

52.84.125.24
server-52-84-125-24.iad16.r.cloudfront.net
July 20, 2016

52.84.125.233
server-52-84-125-233.iad16.r.cloudfront.net
July 20, 2016

52.84.125.210
server-52-84-125-210.iad16.r.cloudfront.net
July 20, 2016

52.84.125.179
server-52-84-125-179.iad16.r.cloudfront.net
July 20, 2016

52.84.125.126
server-52-84-125-126.iad16.r.cloudfront.net
July 20, 2016

52.84.125.112
server-52-84-125-112.iad16.r.cloudfront.net
July 20, 2016

52.84.125.38
server-52-84-125-38.iad16.r.cloudfront.net
July 20, 2016

52.85.131.214
server-52-85-131-214.iad53.r.cloudfront.net
June 29, 2016

52.85.131.91
server-52-85-131-91.iad53.r.cloudfront.net
June 29, 2016

52.85.131.75
server-52-85-131-75.iad53.r.cloudfront.net
June 29, 2016

52.85.131.49
server-52-85-131-49.iad53.r.cloudfront.net
June 29, 2016

52.85.131.48
server-52-85-131-48.iad53.r.cloudfront.net
June 29, 2016

52.85.131.30
server-52-85-131-30.iad53.r.cloudfront.net
June 29, 2016

 
Showing 30 of 104 IP Addresses

File downloads found at URLs served by dl-2.kbm2.com.

0 / 68
http://dl-2.kbm2.com/.../vlc-2.0.3-win32.exe  (79324.tmp)

23 / 68    (Adware)
http://dl-2.kbm2.com/.../DealPly20130529.exe  (dp.exe)

13 / 68    (Adware)
http://dl-2.kbm2.com/.../yontoosetup.exe  (793d4bd.tmp)

8 / 68      (Adware)
http://dl-2.kbm2.com/.../buzzdocka220130220.exe  (buzzdock-a220130215.exe)

1 / 68      (Adware)
http://dl-2.kbm2.com/.../tanzuki20130829.exe  (7939a1e.tmp)

31 / 68    (Adware)
http://dl-2.kbm2.com/.../qv0620130826.exe  (iXB.exe)

0 / 68
http://dl-2.kbm2.com/.../7zip20130116a.exe  (26805-673365-7-zip.exe)

13 / 68    (Adware)
http://dl-2.kbm2.com/.../AmonetizeMobogenie20140219GL.exe  (a1dad7e20cdabee0f8d28fabc1cee355)

0 / 68
http://dl-2.kbm2.com/.../pdflite20131216.exe  (3102838636d48ae299806d01fb5ec1da)

3 / 68      (Adware)
http://dl-2.kbm2.com/.../webfuii20131116.exe  (a168591d06500ab1ab7ed505082ead40)

1 / 68      (inconclusive)
http://dl-2.kbm2.com/.../7zip201300911.exe  (a79a9c3d535a0086ea80cd18198ca146)

7 / 68      (Adware)
http://dl-2.kbm2.com/.../DealPly01032013.exe  (dp.exe)

20 / 68    (Adware)
http://dl-2.kbm2.com/.../yontoosetup.exe  (35fff30bd92a0315d2c8fcec64fc57d1)

5 / 68      (PUP)
http://dl-2.kbm2.com/.../webxvid20130823.exe  (4a98f587190db9cc8bfa48c39121699a)

2 / 68
http://dl-2.kbm2.com/.../vlc-2.0.5-win322013.exe  (vlc-2.0.5-win32.exe)

7 / 68      (Adware)
http://dl-2.kbm2.com/Download/.../JollyWallet_01072013.exe  (5bd84f61cb715edb713cff51ec4a9585)

0 / 68
http://dl-2.kbm2.com/.../Inkscape08282013.exe  (inkscape-0.48.2-1-win32.exe)

4 / 68      (PUP)
http://dl-2.kbm2.com/.../mendfast04222013.exe  (7939a3e.tmp)

20 / 68    (Adware)
http://dl-2.kbm2.com/.../yontoosetup.exe  (5b4b2a705b95c18cc1a3c7d76fb2ea11)

1 / 68      (PUP)
http://dl-2.kbm2.com/.../freesystemutilitiessoftoniccom20130103.exe  (SystemUtilitiesSetup_softonic_com.exe)

1 / 68      (PUP)
http://dl-2.kbm2.com/.../yolo01072013.exe  (39ad40230c7242930db7e995cf88cbc6)

9 / 68      (PUP)
http://dl-2.kbm2.com/.../Mobogenie20131105.exe  (793df78.tmp)

3 / 68      (Adware)
http://dl-2.kbm2.com/.../vuupc20130730.exe  (f8b26f9227a1d05545f702b98c35cd07)

7 / 68      (Adware)
http://dl-2.kbm2.com/.../DoughGo20140505.exe  (doughgo20140401.exe)

2 / 68      (PUP)
http://dl-2.kbm2.com/.../mypcbackup20130923.exe  (1276d72f9c1718244e458093d2bcfcd8)

4 / 68      (Adware)
http://dl-2.kbm2.com/Download/.../Alnaddytoolbar09072012.exe  (toolbar.exe)

1 / 68      (PUP)
http://dl-2.kbm2.com/Download/.../VisualBee112012.exe  (c1cbfe63310b3f5101311340f66b2e5f)

9 / 68      (Adware)
http://dl-2.kbm2.com/.../AMSpeedUpMyPC20140303.exe  (bundle.exe)

The following 62 files have been seen to comunicate with dl-2.kbm2.com in live environments.

TCP » 54.230.193.129:443
online-guardian-v2.0.9.exe

TCP » 54.192.195.231:443
online-guardian-v2.0.9.exe

TCP » 52.84.125.186:80
se.exe

TCP » 52.85.142.179:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.84.125.126:80
crossbrowse.exe (Crossbrowse)

TCP » 54.230.193.129:443
online-guardian-v2.0.9.exe

TCP » 52.85.131.148:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.84.125.211:443
clearscreenplayerbrowser.exe

TCP » 52.85.131.30:443
browser.exe (Browser)

TCP » 52.84.125.129:443
browser.exe (Speed Browser by Smart Applications)

TCP » 52.84.125.129:443
bobrowser.exe (BoBrowser by The BoBrowser Authors)

TCP » 52.84.125.126:80
se.exe

TCP » 52.84.125.12:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.84.125.143:443
UCBrowser.exe (by UCWeb)

TCP » 52.84.125.112:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.84.125.126:80
browser.exe (Browser)

TCP » 52.84.125.129:443
UCBrowser.exe (by UCWeb)

TCP » 54.192.192.189:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.84.125.116:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.84.125.176:443
citrio.exe (Citrio by CatalinaGroup)

 
Latest 20 of 212 files

URL:
http://dl-2.kbm2.com/

Network:
Amazon Cloudfront

Web server:
Microsoft-IIS/7.5 (UrlRewriter.NET 2.0.0,ASP.NET)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.