inndl.com

WHOISGUARD, INC.  (Proxy Registrant)

Domain Information

The domain inndl.com is registered by proxy through ENOM, INC. and was originally registered in March of 2014. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Phoenix, Arizona within the United States which resides on the CloudFlare, Inc. network. The domain uses the CloudFlare CDN, a distributed domain name server service which utilizes a number of reverse proxy IP Addresses (see below).
Remove Malware from inndl.com - Powered by Reason Core Security
Registrar:
ENOM, INC.

Server location:
Arizona, United States (US)

Create date:
Saturday, March 29, 2014

Expires date:
Tuesday, March 29, 2016

Updated date:
Friday, February 27, 2015

ASN:
AS13335 CLOUDFLARENET - CloudFlare, Inc.,US

Google Safe Browsing:
unwanted

Scanner detections:
Detections  (96% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.WorldSetup.W, PUP.FITDownloader.U, PUP.FITDownloader.K, PUP.FITDownloader.L, PUP.FITDownloader.S, PUP.MaxSetup.O, PUP.FITDownloader.J, PUP.FITDownloader.F, PUP.FITDownloader.P, PUP.FITDownloader.c, PUP.FITDownloader.T, PUP.Installer.FITDownloader.AA, PUP.FITDownloader.G, PUP.FITDownloader.M, PUP.Installer.FITDownloader.Q, PUP.FITDownloader.Q, PUP.FITDownloader.Y, PUP.Installer.FITDownloader.F, PUP.Installer.FITDownloader.G, Threat.Installer.FITDownloader, PUP.FITDownloader.Installer (M), PUP.installCore.FITDownloader (M), PUP.installCore.FITDownloader.Installer (M), PUP.installCore.MaxSetup (M)
97.92%

AVG
MalSign.Generic, BundleApp, InstallCore, Adware InstallCore.LO
64.58%

K7 AntiVirus
Unwanted-Program , Trojan
60.42%

K7 Gateway Antivirus
Unwanted-Program , Trojan
60.42%

Sophos
Install Core, Install Core Click run software, PUA 'Install Core Click run software'
60.42%

VIPRE Antivirus
Trojan.Win32.Generic, Threat.4150696, Threat.5063361, Threat.4788237, Threat.4786018
60.42%

Dr.Web
Trojan.Packed.24524, Adware.InstallCore.464, Trojan.MulDrop5.10078
58.33%

ESET NOD32
Win32/InstallCore.PL potentially unwanted application, Win32/InstallCore.OX potentially unwanted application, Win32/InstallCore.PS potentially unwanted application, Win32/InstallCore.AEO.gen potentially unwanted application
56.25%

McAfee Web Gateway
Artemis!6D66CE925BF4, Artemis!F0C27F8E05AA, BehavesLike.Win32.CryptInno.bc, BehavesLike.Win32.Jeefo.jc, Artemis!8EBC2EA6D879
50.00%

F-Prot
W32/A-6c5f2e7b, W32/A-dbe1ec51, W32/InstallCore.AC.gen, W32/InstallCore.AG.gen, W32/A-2d45491d
47.92%

Avira AntiVirus
ADWARE/InstallCore.Gen7, ADWARE/InstallCore.Gen9, TR/Spy.706160, Adware/InstallCore.PL.7, Adware/InstallCore.A.148, Adware/InstallCo.zkr
39.58%

Malwarebytes
PUP.Optional.InstallCore, PUP.Optional.InstallCore.A
33.33%

Vba32 AntiVirus
Downware.InstallCore, Malware-Cryptor.InstallCore.gen
31.25%

NANO AntiVirus
Riskware.Win32.InstallCore.dcnbmr, Riskware.Text.Drop.defxvn, Riskware.Win32.InstallCore.dfglmj, Riskware.Win32.InstallCore.dfglku
27.08%

herdProtect (fuzzy)
a variant of 4a9a8867866b9ab554d34f4e783af8de1a1877cd, a variant of a6df91ffadb50e9d587cb2ca14377cc8b202ffa0, a variant of 14b32bb926feee1f556b19224bbc8d87fa0f3f5a
12.50%

The domain inndl.com has been seen to resolve to the following 5 IP addresses.

November 19, 2015

November 19, 2015

May 2, 2015

May 2, 2015

April 4, 2014

File downloads found at URLs served by inndl.com.

 
Latest 30 of 129 download URLs

March 21, 2015

URL:
http://inndl.com/

Title:
“Welcome to nginx!”

SSL certificate subject:
CN=ssl279433.cloudflaressl.com, OU=PositiveSSL Multi-Domain, OU=Domain Control Validated

SSL certificate issuer:
CN=COMODO RSA Domain Validation Secure Server CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Web server:
cloudflare-nginx

Remove Malware from inndl.com - Powered by Reason Core Security