home

download.refog.com

REFOG INC

Domain Information

The domain download.refog.com registered by REFOG INC was initially registered in August of 2002 through ENOM, INC.. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in New York City, New York within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Cloudfront CDN service which utilizes a number of proxy IP Addresses (see below).
Registrar:
ENOM, INC.

Server location:
New York, United States (US)

Create date:
Saturday, August 10, 2002

Expires date:
Thursday, August 5, 2021

Updated date:
Thursday, October 17, 2013

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.

Root domain:
refog.com

Whois:
1 refog.com record

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

VIPRE Antivirus
Refog Inc., Threat.4675967
100.00%

McAfee
Keylog-Refog, Program.Keylog-Refog
100.00%

K7 AntiVirus
Unwanted-Program , Password-Stealer
100.00%

Trend Micro House Call
TROJ_GEN.F47V1208, TROJ_SPNV.03JM13
100.00%

avast!
Win32:Refog-A [PUP]
100.00%

Kaspersky
not-a-virus:Monitor.Win32.KeyLogger, Trojan-Spy.Win32.KeyLogger
100.00%

Sophos
Generic PUA NM, Generic PUA DA
100.00%

Comodo Security
UnclassifiedMalware
100.00%

IKARUS anti.virus
not-a-virus:Monitor.Win32.Keylogger, not-a-virus:Monitor.Win32.KGBSpy
100.00%

Reason Heuristics
PUP.Installer.Refog
100.00%

Malwarebytes
PUP.Keylogger
100.00%

Norman
KeyLogger.MPD
100.00%

Fortinet FortiGate
Riskware/KeyLogger, Riskware/KGBSpy
100.00%

Bkav FE
W32.Clodccc.Trojan
50.00%

MicroWorld eScan
Trojan.Generic.10357808
50.00%

The domain download.refog.com has been seen to resolve to the following 8 IP addresses.

54.230.54.103
server-54-230-54-103.jfk6.r.cloudfront.net
January 25, 2014

54.240.190.138
server-54-240-190-138.jfk6.r.cloudfront.net
January 25, 2014

54.230.52.198
server-54-230-52-198.jfk6.r.cloudfront.net
January 25, 2014

54.240.190.148
server-54-240-190-148.jfk6.r.cloudfront.net
January 25, 2014

54.230.52.164
server-54-230-52-164.jfk6.r.cloudfront.net
January 25, 2014

54.230.52.246
server-54-230-52-246.jfk6.r.cloudfront.net
January 25, 2014

54.240.190.105
server-54-240-190-105.jfk6.r.cloudfront.net
January 25, 2014

54.230.53.212
server-54-230-53-212.jfk6.r.cloudfront.net
January 25, 2014

File downloads found at URLs served by download.refog.com.

22 / 68    (PUP)
http://download.refog.com/refog_setup_kl_7xx.exe  (3994cc24-5a9c-4b84-8bde-e17e5a787682.exe)

20 / 68    (PUP)
http://download.refog.com/refog_setup_pm_7xx.exe  (117eac4cd6c9ecd64a1e7fe0c2e37263)

The following 6 files have been seen to comunicate with download.refog.com in live environments.

TCP » 54.230.52.164:80
open officesetup.exe

TCP » 54.230.52.164:80
searchupdater.exe

TCP » 54.230.52.246:80
launcher__12693.exe

TCP » 54.230.52.246:80
uninstall symantec endpoint protection 12.1 removal tool__10924_i1528718723_il277467.exe

TCP » 54.230.52.246:80
total commander 8.50 portable keys, serial number plus crack full download__10924_i1536436517_il1551

TCP » 54.230.52.246:80
nsx7f3e.tmp

URL:
http://download.refog.com/

Google Analytics:
UA-888581

Title:
“Refog - Downloading Refog - Keylogger Software”

Description:
“Keylogger Software”

Network:
Amazon Cloudfront

Web server:
AmazonS3

Alexa:
US rank:  151,323
Global rank:  171,777
Backlinks:  906

Statistics are for the previous month (Alexa statistics are for entire refog.com).

hoverwatch.com

mipko.ru

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.