home

get.volcanobeaver.men

Domain Information

Server location:
Washington, United States (US)

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc., US

Root domain:
volcanobeaver.men

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
Adware.Bundler
100.00%

The domain get.volcanobeaver.men has been seen to resolve to the following 8 IP addresses.

52.84.125.109
server-52-84-125-109.iad16.r.cloudfront.net
September 1, 2016

52.84.125.69
server-52-84-125-69.iad16.r.cloudfront.net
September 1, 2016

52.84.125.68
server-52-84-125-68.iad16.r.cloudfront.net
September 1, 2016

52.84.125.8
server-52-84-125-8.iad16.r.cloudfront.net
September 1, 2016

52.84.125.254
server-52-84-125-254.iad16.r.cloudfront.net
September 1, 2016

52.84.125.185
server-52-84-125-185.iad16.r.cloudfront.net
September 1, 2016

52.84.125.170
server-52-84-125-170.iad16.r.cloudfront.net
September 1, 2016

52.84.125.134
server-52-84-125-134.iad16.r.cloudfront.net
September 1, 2016

File downloads found at URLs served by get.volcanobeaver.men.

1 / 68      (PUP)
http://get.volcanobeaver.men/?mRMeooJnd5yJUraj_PLUS_M_PLUS_P1M_PLUS_iVsZc76FS9HbLqwH7Pz0_EQUALS_&flp=1  (download.exe)

1 / 68      (PUP)
http://get.volcanobeaver.men/?TSPYApDhbzIvj_SLASH_In4uWoYW_SLASH_SfqRhcrVORP5uhcL_PLUS_MZ0_EQUALS_&flp=1  (tag.exe)

The following 11 files have been seen to comunicate with get.volcanobeaver.men in live environments.

TCP » 52.84.125.170:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.84.125.170:443
whatsapptime.exe

TCP » 52.84.125.254:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.84.125.254:443
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.84.125.170:443
online-guardian-v2.0.9.exe

TCP » 52.84.125.185:443
cpx.exe (Google Embedded Application)

TCP » 52.84.125.134:443
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.84.125.170:443
online-guardian-v2.0.9.exe

TCP » 52.84.125.254:80
minionstribute_theme.crx

TCP » 52.84.125.68:80
browser.exe (Browser)

TCP » 52.84.125.68:80
Trezaa.Service.exe (Trezaa.Service by Microsoft)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.