The domain dw59o80yvpenp.cloudfront.net registered by Amazon.com, Inc was initially registered in April of 2008 through MARKMONITOR INC.. Currently this domain has been known to host various forms of malware. The hosted servers are located in Seattle, Washington within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Cloudfront CDN service which utilizes a number of proxy IP Addresses (see below).
Registrant:
Amazon.com, Inc
Registrar:
MARKMONITOR INC.
Server location:
Washington, United States (US)
Create date:
Friday, April 25, 2008
Expires date:
Thursday, April 25, 2019
Updated date:
Thursday, May 5, 2016
ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US
Scanner detections:
Malware distribution (100% detected)
Scan engine
Details
Detections
Dr.Web
Trojan.DownLoader21.48868, Trojan.Crossrider1.58013, Win32.Virut.56, Win32.Sector.30
85.71%
avast!
Win32:Adware-gen [Adw], Win32:Evo-gen [Susp], Win32:Vitro, Win32:Virtu-A, Win32:Kukacka
71.43%
McAfee
Trojan.Artemis!5CAB39F64FA6, Virus.W32/Virut.n.gen, Trojan.RDN/Generic Downloader.x
57.14%
ESET NOD32
MSIL/Adware.Imali.C application, Win32/Virut.NBP virus, Win32/Sality.NBA virus
57.14%
Emsisoft Anti-Malware
Gen:Variant.Razy.18672, Win32.Virtob.Gen.12, Win32.Sality
57.14%
Microsoft Security Essentials
Threat.Undefined
42.86%
F-Prot
W32/Virut.AL!Generic, W32/Virut.E.gen, W32/Sality.gen2
42.86%
AVG
Win32/Virut, Win32/Sality
42.86%
Norman
Win32.Virtob.Gen.12, Win32.Sality.3
42.86%
Reason Heuristics
Adware.Downloader, Threat.Win.Reputation.IMP
28.57%
Kaspersky
Virus.Win32.Virut, Virus.Win32.Sality
28.57%
MicroWorld eScan
Gen:Variant.Razy.18672
14.29%
Malwarebytes
PUP.Optional.Amonetize
14.29%
Bitdefender
Gen:Variant.Razy.18672
14.29%
K7 AntiVirus
Adware
14.29%
The domain dw59o80yvpenp.cloudfront.net has been seen to resolve to the following 43 IP addresses.
server-52-84-125-181.iad16.r.cloudfront.net
July 6, 2016
server-52-84-125-157.iad16.r.cloudfront.net
July 6, 2016
server-52-84-125-137.iad16.r.cloudfront.net
July 6, 2016
server-52-84-125-133.iad16.r.cloudfront.net
July 6, 2016
server-52-84-125-132.iad16.r.cloudfront.net
July 6, 2016
server-52-84-125-18.iad16.r.cloudfront.net
July 6, 2016
server-52-84-125-234.iad16.r.cloudfront.net
July 6, 2016
server-52-84-125-201.iad16.r.cloudfront.net
July 6, 2016
server-52-84-125-66.iad16.r.cloudfront.net
July 4, 2016
server-52-84-125-254.iad16.r.cloudfront.net
July 4, 2016
server-52-84-125-252.iad16.r.cloudfront.net
July 4, 2016
server-52-84-125-250.iad16.r.cloudfront.net
July 4, 2016
server-52-84-125-204.iad16.r.cloudfront.net
July 4, 2016
server-52-84-125-84.iad16.r.cloudfront.net
July 4, 2016
server-52-84-125-80.iad16.r.cloudfront.net
July 4, 2016
server-52-84-125-78.iad16.r.cloudfront.net
July 4, 2016
server-52-85-131-245.iad53.r.cloudfront.net
July 3, 2016
server-52-85-131-136.iad53.r.cloudfront.net
July 3, 2016
server-52-85-131-114.iad53.r.cloudfront.net
July 3, 2016
server-52-85-131-83.iad53.r.cloudfront.net
July 3, 2016
server-52-85-131-58.iad53.r.cloudfront.net
July 3, 2016
server-52-85-131-41.iad53.r.cloudfront.net
July 3, 2016
server-52-85-131-28.iad53.r.cloudfront.net
July 3, 2016
server-52-85-131-4.iad53.r.cloudfront.net
July 3, 2016
server-52-85-131-133.iad53.r.cloudfront.net
June 7, 2016
server-52-85-131-100.iad53.r.cloudfront.net
June 7, 2016
server-52-85-131-23.iad53.r.cloudfront.net
June 7, 2016
server-52-85-131-185.iad53.r.cloudfront.net
June 4, 2016
server-52-85-131-86.iad53.r.cloudfront.net
June 4, 2016
server-52-85-131-84.iad53.r.cloudfront.net
June 4, 2016
Showing 30 of 43 IP Addresses
File downloads found at URLs served by dw59o80yvpenp.cloudfront.net.
The following 45 files have been seen to comunicate with dw59o80yvpenp.cloudfront.net in live environments.
URL:
http://dw59o80yvpenp.cloudfront.net/
Network:
Amazon Cloudfront
SSL certificate subject:
CN=*.cloudfront.net, O="Amazon.com, Inc.", L=Seattle, S=Washington, C=US
SSL certificate issuer:
CN=Symantec Class 3 Secure Server CA - G4, OU=Symantec Trust Network, O=Symantec Corporation, C=US