home

google.com.vn

Domain Information

Server location:
California, United States (US)

ASN:
AS15169 GOOGLE - Google Inc., US

Scanner detections:
Malware distribution  (67% detected)

Scan engine
Details
Detections

Bkav FE
W32.DownloadNymaimN.Trojan, W32.NapolarBuzusA.Trojan
100.00%

MicroWorld eScan
Gen:Variant.Kazy.364398, Trojan.GenericKDZ.25020
100.00%

Quick Heal
TrojanPWS.Fareit.r5, Trojan.Agent.r4
100.00%

Malwarebytes
Spyware.Passwords, Spyware.Zbot.ED
100.00%

K7 AntiVirus
Riskware , Trojan
100.00%

Arcabit
Trojan.Kazy.D58F6E, Trojan.Generic.D61BC
100.00%

Agnitum Outpost
Trojan.PWS.Fareit, Trojan.Injector
100.00%

ESET NOD32
Win32/PSW.Fareit
100.00%

Trend Micro House Call
TSPY_FAREIT.VAPK, TROJ_SPNR.0BDM14
100.00%

avast!
Win32:Dropper-gen [Drp], Win32:Injector-BRO [Trj]
100.00%

Kaspersky
HEUR:Trojan.Win32.Generic
100.00%

Bitdefender
Gen:Variant.Kazy.364398, Trojan.GenericKDZ.25020
100.00%

NANO AntiVirus
Trojan.Win32.Fareit.cwmqex, Trojan.Win32.Fareit.cwwycs
100.00%

Lavasoft Ad-Aware
Gen:Variant.Kazy.364398, Trojan.GenericKDZ.25020
100.00%

Emsisoft Anti-Malware
Gen:Variant.Kazy.364398, Trojan.GenericKDZ.25020
100.00%

The domain google.com.vn has been seen to resolve to the following 7 IP addresses.

172.217.1.67
lga15s44-in-f3.1e100.net
September 13, 2016

209.85.232.94
August 1, 2016

172.217.1.195
iad23s26-in-f3.1e100.net
June 19, 2016

172.217.4.35
lga15s46-in-f3.1e100.net
June 2, 2016

172.217.1.3
iad23s25-in-f3.1e100.net
May 19, 2016

172.217.2.195
iad23s23-in-f3.1e100.net
April 16, 2016

216.58.217.67
iad23s41-in-f3.1e100.net
April 8, 2016

File downloads found at URLs served by google.com.vn.

33 / 68    (Malware)
http://google.com.vn/setup.exe  (62b62a087e65aa4ff0ddcfafe17f63e2)

0 / 68
http://google.com.vn/setup.exe  (76048e3e840205ca5fc73afc364b127e)

34 / 68    (Malware)
http://google.com.vn/setup.exe  (b9f0e15879ab6ac596de11582995af3d)

The following 20 files have been seen to comunicate with google.com.vn in live environments.

TCP » 209.85.232.94:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 209.85.232.94:443
citrio.exe (Citrio by CatalinaGroup)

TCP » 209.85.232.94:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 209.85.232.94:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 209.85.232.94:443
browser.exe (Browser)

TCP » 209.85.232.94:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 209.85.232.94:443
online-guardian-v2.exe

TCP » 209.85.232.94:80
bdc75287-990c-4562-9359-42a7584090a3-10.exe (PalMall by BND)

TCP » 209.85.232.94:443
online-guardian.exe

TCP » 209.85.232.94:443
dailywiki.exe

TCP » 209.85.232.94:443
stormwatchbrowser.exe

TCP » 209.85.232.94:443
UpdateAdmin.exe (by DownloadAdmin)

TCP » 172.217.1.195:443
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 172.217.1.67:443
browser.exe (Speed Browser by Smart Applications)

TCP » 172.217.1.67:80
browser.exe (Browser)

TCP » 172.217.4.35:443
browser.exe (Speed Browser by Long Mile Solutions)

TCP » 172.217.4.35:443
catwsprx.exe (CatWSPrx.exe by Catalytix Web Services)

TCP » 172.217.4.35:443
browser.exe (Speed Browser by Smart Applications)

TCP » 209.85.232.94:443
mybrowser.exe (MyBrowser)

TCP » 216.58.217.67:443
netman.exe

 
Latest 20 of 27 files

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.