The domain flv.hs3dmr.com is registered by proxy through GODADDY.COM, LLC and was originally registered in June of 2013. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Scottsdale, Arizona within the United States which resides on the GoDaddy.com, LLC network.
Registrant:
Domains By Proxy, LLC
Registrar:
GODADDY.COM, LLC
Server location:
Arizona, United States (US)
Create date:
Friday, June 14, 2013
Expires date:
Tuesday, June 14, 2016
Updated date:
Monday, June 15, 2015
ASN:
AS26496 AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
Scanner detections:
Detections (98% detected)
Scan engine
Details
Detections
Reason Heuristics
PUP.Installer.BechiroSL.O, PUP.Installer.InstallManager.H, PUP.Installer.InstallManager.F, PUP.Installer.AppsInstallerSL.F, PUP.Installer.BechiroSL.F, PUP.Installer.Solimba, PUP.Installer.Adknowledge, PUP.Solimba.AppsInstaller.Installer (M), PUP.Solimba.Bechiro.Bundler (M), PUP.Outbrowse.Bundler (M), PUP.Adknowledge.InstallManager.Installer (M), Adware.WebPick.Installer (M), PUP.Adknowledge.SETUPDOTEXE.Bundler (M), PUP.Linkular.Company.Installer (M), PUP.Solimba.AppsInst.Bundler (M), PUP.Softpulse.PluginUp.Bundler (M), PUP.Adknowledge.FileMona.Bundler (M), PUP.Solimba (M)
95.83%
VIPRE Antivirus
DownloadMR, Threat.4784938, Threat.4782980, Backdoor.Win32.Bifrose.fsi, Threat.4150696
47.92%
Dr.Web
Trojan.SMSSend.5407, Adware.Downware.1125, Adware.Downware.1302, Trojan.SMSSend.5438, Adware.InstallCore.101, Adware.InstallCore.122
45.83%
ESET NOD32
Win32/AirAdInstaller.A potentially unwanted application, MSIL/Solimba potentially unwanted application, Win32/InstallCore.BY potentially unwanted application
45.83%
Sophos
AirInstaller, Solimba Installer, PUA.Solimba Installer, PUA 'Solimba Installer', PUA 'AirInstaller', PUA 'Install Core Click run software'
45.83%
Malwarebytes
PUP.Optional.InstallCore, PUP.Optional.InstallManager, PUP.Optional.AirAdInstaller, PUP.Optional.Solimba
43.75%
Rising Antivirus
PE:Malware.FirseriaInstaller!6.17AF, PE:PUF.Airinstall!1.9C4C, PE:PUF.FirseriaInstaller@CV!1.5C42, PE:Malware.InstallCore!6.4
43.75%
AVG
BundleApp, Generic, Adware Skodna.Generic.ALF
43.75%
avast!
Adware-gen [Adw], Solimba-C [PUP], Win32:Adware-BZI [PUP], Win32:Installer-I [PUP], Morstar-U [PUP], Win32:SoftPulse-FZ [PUP]
43.75%
K7 AntiVirus
Unwanted-Program , Adware
41.67%
Vba32 AntiVirus
Downware.Morstar, AdWare.AirAdInstaller, Signed-Downware.Morstar.AppsInstallerSL, Signed-Downware.Morstar.BechiroSL, Downware.InstallCore
41.67%
Agnitum Outpost
PUA.AirAd, PUA.Solimba, PUA.InstallCore
41.67%
Avira AntiVirus
ADWARE/Adware.Gen, APPL/Solimba.Gen, TR/Trash.Gen
41.67%
NANO AntiVirus
Trojan.Win32.SMSSend.ddvfxt, Riskware.Win32.Solimba.daewcj, Trojan.Win32.DownLoad3.daevxj, Riskware.Win32.InstallCore.dcuoau
41.67%
G Data
Win32.Application.Morstar, Win32.Adware.Airadinstaller, MSIL.Application.Solimba, Win32.Application.InstallCore.CJ
39.58%
The domain flv.hs3dmr.com has been seen to resolve to the following 11 IP addresses.
ip-50-63-202-39.ip.secureserver.net
July 16, 2015
ip-50-63-202-49.ip.secureserver.net
June 26, 2015
ec2-54-175-84-195.compute-1.amazonaws.com
May 5, 2015
ec2-54-175-1-157.compute-1.amazonaws.com
May 5, 2015
ec2-54-173-20-116.compute-1.amazonaws.com
May 5, 2015
ec2-54-85-61-67.compute-1.amazonaws.com
September 3, 2014
ec2-107-23-215-172.compute-1.amazonaws.com
September 3, 2014
ec2-107-23-174-40.compute-1.amazonaws.com
September 3, 2014
ec2-107-21-26-80.compute-1.amazonaws.com
April 14, 2014
ec2-54-209-198-39.compute-1.amazonaws.com
April 14, 2014
ec2-54-84-127-0.compute-1.amazonaws.com
April 14, 2014
File downloads found at URLs served by flv.hs3dmr.com.
Latest 30 of 49 download URLs
The following 15 files have been seen to comunicate with flv.hs3dmr.com in live environments.
URL:
http://flv.hs3dmr.com/
Web server:
Microsoft-IIS/7.5 (ASP.NET) (Version: 4.0.30319)