dl.safemonitorapp.com

WebAppTech Coding LLC  (via a Proxy Registrant)

Domain Information

The domain dl.safemonitorapp.com is registered by proxy through GODADDY.COM, LLC and was originally registered in January of 2013. This domain has been known to host and distribute potentially unwanted software. The hosted servers are located in Dulles, Virginia within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Cloudfront CDN service which utilizes a number of proxy IP Addresses (see below). The domain is associated with the publisher WebAppTech Coding LLC who is located in Grandville, Michigan in the United States.
Registrar:
GODADDY.COM, LLC

Server location:
Virginia, United States (US)

Create date:
Saturday, January 19, 2013

Expires date:
Thursday, January 19, 2017

Updated date:
Wednesday, January 20, 2016

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:

Scanner detections:
Detections  (96% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Installer.WesternWebApplications.F, PUP.Installer.WebAppTechCoding.F, PUP.LionSea.LionSeaS.Installer (M), PUP.Installer.WebAppTechCoding.I, DownloadManager.AirSoftware.F, PUP.Installer.Injekt, PUP.Injekt.WesternWebApplications.Installer (M), PUP.Injekt.WesternW.Installer (M), PUP.Softpulse (M)
97.92%

Dr.Web
Adware.Plugin.36, riskware program Program.Unwanted.79, is riskware program Program.Unwanted.79, Trojan.SMSSend.4766, infected with Trojan.Yontoo.2143
72.92%

VIPRE Antivirus
SearchDonkey, Injekt, Iminent, Threat.4784449
70.83%

ESET NOD32
Win32/ExFriendAlert (variant), MSIL/Adware.PullUpdate
56.25%

Trend Micro House Call
TROJ_GEN.F47V0601, TROJ_FAKEAV.BMC, TROJ_GE.269D89E4, TROJ_GE.7B758086, TROJ_GEN.F47V0324, TROJ_GE.0C72B010, TROJ_GEN.F47V1115, TROJ_GEN.F47V0603, TROJ_GE.CFFE2CD1, TROJ_GEN.F47V0623
43.75%

Malwarebytes
Trojan.Agent.HE, Adware.SaMon, PUP.Optional.Conduit.A, PUP.Optional.AirInstaller, PUP.Optional.SafeMonitor.A
41.67%

Kingsoft AntiVirus
VIRUS_UNKNOWN, Win32.Troj.Generic.a.(kcloud), Win32.Troj.AirAdInstall.al.(kcloud)
39.58%

McAfee
Artemis!746F02AD95F1, Artemis!C2B4BC7A8347, Artemis!913B2DA85CD4, Artemis!B7689FE1B383, Artemis!5A7E0A5F30C1, Artemis!8E01FFB62C72, Artemis!BD101DACC599, Artemis!5DF05C1AE745, Artemis!B76C76ABE40E, Artemis!72CB9F4C5846, Artemis!311C6C38DBF2
31.25%

Comodo Security
Heur.Suspicious, ApplicUnwnt, Application.Win32.AirAdInstaller.A
31.25%

Vba32 AntiVirus
suspected of Trojan.Downloader.gen.h, TScope.Trojan.MSIL, AdWare.SaMon, AdWare.AirAdInstaller.ajov
29.17%

Agnitum Outpost
Riskware.Agent, PUA.PullUpdate, PUA.AirAd
29.17%

avast!
Win32:BHO-AMO [PUP], JS:BHO-O [PUP], JS:BHO-N [PUP], Adware-gen [Adw]
27.08%

IKARUS anti.virus
AdWare.Win32.ExFriendAlert, not-a-virus:AdWare.Win32.SaMon, AdWare.Agent, Win32.AdWare, PUA.ExFriendAlert, AdWare.MSIL.PullUpdate
25.00%

McAfee Web Gateway
Artemis!746F02AD95F1, Artemis!C2B4BC7A8347, Artemis!8E01FFB62C72, Artemis!74BC6BDE3C09, Artemis!BD101DACC599, Artemis!447AA957F725
22.92%

Antiy Labs AVL
Trojan/Win32.SGeneric, GrayWare[AdWare:not-a-virus]/Win32.AirAdInstaller, Trojan/Win32.TSGeneric, GrayWare[Downloader:not-a-virus]/Win32.Adload.gen
20.83%

The domain dl.safemonitorapp.com has been seen to resolve to the following 186 IP addresses.

server-52-84-125-252.iad16.r.cloudfront.net
September 3, 2016

server-52-84-125-230.iad16.r.cloudfront.net
September 3, 2016

server-52-84-125-214.iad16.r.cloudfront.net
September 3, 2016

server-52-84-125-110.iad16.r.cloudfront.net
September 3, 2016

server-52-84-125-102.iad16.r.cloudfront.net
September 3, 2016

server-52-84-125-56.iad16.r.cloudfront.net
September 3, 2016

server-52-84-125-27.iad16.r.cloudfront.net
September 3, 2016

server-52-84-125-16.iad16.r.cloudfront.net
September 3, 2016

server-52-85-131-76.iad53.r.cloudfront.net
July 19, 2016

server-52-85-131-62.iad53.r.cloudfront.net
July 19, 2016

server-52-85-131-29.iad53.r.cloudfront.net
July 19, 2016

server-52-85-131-243.iad53.r.cloudfront.net
July 19, 2016

server-52-85-131-242.iad53.r.cloudfront.net
July 19, 2016

server-52-85-131-206.iad53.r.cloudfront.net
July 19, 2016

server-52-85-131-185.iad53.r.cloudfront.net
July 19, 2016

server-52-85-131-142.iad53.r.cloudfront.net
July 19, 2016

server-52-85-142-249.iad12.r.cloudfront.net
May 28, 2016

server-52-85-142-108.iad12.r.cloudfront.net
May 24, 2016

server-52-85-142-64.iad12.r.cloudfront.net
May 24, 2016

server-52-85-142-50.iad12.r.cloudfront.net
May 24, 2016

server-52-85-142-254.iad12.r.cloudfront.net
May 24, 2016

server-52-85-142-244.iad12.r.cloudfront.net
May 24, 2016

server-52-85-142-128.iad12.r.cloudfront.net
May 24, 2016

server-52-85-142-122.iad12.r.cloudfront.net
May 24, 2016

server-52-85-142-89.iad12.r.cloudfront.net
April 21, 2016

server-52-85-142-81.iad12.r.cloudfront.net
April 21, 2016

server-52-85-142-47.iad12.r.cloudfront.net
April 21, 2016

server-52-85-142-43.iad12.r.cloudfront.net
April 21, 2016

server-52-85-142-14.iad12.r.cloudfront.net
April 21, 2016

server-52-85-142-201.iad12.r.cloudfront.net
April 21, 2016

 
Showing 30 of 186 IP Addresses

File downloads found at URLs served by dl.safemonitorapp.com.

1 / 68      (Adware)

17 / 68    (Adware)

1 / 68      (Adware)

1 / 68      (Adware)

1 / 68      (Adware)

5 / 68      (Adware)

8 / 68      (Adware)

1 / 68      (Adware)

10 / 68    (Adware)

5 / 68      (Adware)

1 / 68      (Adware)

4 / 68      (Adware)

0 / 68

1 / 68      (Adware)

3 / 68      (Adware)

1 / 68      (Adware)

1 / 68      (Adware)

11 / 68    (PUP)

1 / 68      (Adware)

10 / 68    (Adware)

2 / 68      (PUP)

9 / 68      (Adware)

18 / 68    (Adware)

20 / 68    (Adware)

8 / 68      (Adware)

9 / 68      (Adware)

13 / 68    (Adware)

17 / 68    (Adware)

15 / 68    (Adware)

9 / 68      (Adware)

 
Latest 30 of 50 download URLs

The following 168 files have been seen to comunicate with dl.safemonitorapp.com in live environments.

 
Latest 20 of 285 files

URL:
http://dl.safemonitorapp.com/

Title:
“SafeMonitor Site”

Network:
Amazon Cloudfront

Web server:
AmazonS3