installercdn.filebulldog.com

Somoto Ltd.  (via a Proxy Registrant)

Domain Information

The domain installercdn.filebulldog.com is registered by proxy through GODADDY.COM, LLC and was originally registered in August of 2010. This domain has been known to host and distribute potentially unwanted software. The hosted servers are located in Seattle, Washington within the United States. The domain uses the Amazon Cloudfront CDN service which utilizes a number of proxy IP Addresses (see below). The domain is associated with the publisher Somoto Ltd. who is located in Tel Aviv, Israel.
Registrar:
GODADDY.COM, LLC

Server location:
Washington, United States (US)

Create date:
Sunday, August 8, 2010

Expires date:
Tuesday, August 8, 2017

Updated date:
Sunday, August 9, 2015

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

F-Prot
W32/SomotoBetterInstaller.A
66.67%

avast!
Win32:Somoto-F [PUP], Win32:Somoto-B [PUP]
66.67%

Sophos
Somoto BetterInstaller
66.67%

Dr.Web
Adware.Somoto.4, Adware.Somoto.8
66.67%

ESET NOD32
Win32/Somoto, Win32/Somoto (variant)
66.67%

Malwarebytes
PUP.Optional.Somoto.A
66.67%

VIPRE Antivirus
BetterInstaller
66.67%

Reason Heuristics
PUP.Installer.Somoto.N, Win32.Generic
66.67%

Boost by Reason
Trojan.Adw.Installer.Somoto.N
33.33%

nProtect
Trojan/W32.Agent.141216
33.33%

Trend Micro House Call
ADW_SOMOTO
33.33%

Clam AntiVirus
Win.Adware.Toolbar-1
33.33%

Trend Micro
ADW_SOMOTO
33.33%

Fortinet FortiGate
Adware/Toolbar
33.33%

Bkav FE
W32.Clod191.Trojan
33.33%

The domain installercdn.filebulldog.com has been seen to resolve to the following 24 IP addresses.

server-54-230-102-219.iad2.r.cloudfront.net
April 18, 2016

server-54-230-102-161.iad2.r.cloudfront.net
April 18, 2016

server-54-230-102-120.iad2.r.cloudfront.net
April 18, 2016

server-54-230-102-119.iad2.r.cloudfront.net
April 18, 2016

server-54-230-102-90.iad2.r.cloudfront.net
April 18, 2016

server-54-230-102-49.iad2.r.cloudfront.net
April 18, 2016

server-54-230-102-35.iad2.r.cloudfront.net
April 18, 2016

server-54-230-102-28.iad2.r.cloudfront.net
April 18, 2016

server-54-230-102-81.iad2.r.cloudfront.net
February 22, 2016

server-54-230-102-67.iad2.r.cloudfront.net
February 22, 2016

server-54-230-102-46.iad2.r.cloudfront.net
February 22, 2016

server-54-230-102-24.iad2.r.cloudfront.net
February 22, 2016

server-54-230-102-198.iad2.r.cloudfront.net
February 22, 2016

server-54-230-102-179.iad2.r.cloudfront.net
February 22, 2016

server-54-230-102-142.iad2.r.cloudfront.net
February 22, 2016

server-54-230-102-100.iad2.r.cloudfront.net
February 22, 2016

server-54-192-195-160.iad53.r.cloudfront.net
February 4, 2016

server-54-192-195-131.iad53.r.cloudfront.net
February 4, 2016

server-54-192-195-39.iad53.r.cloudfront.net
February 4, 2016

server-54-192-195-254.iad53.r.cloudfront.net
February 4, 2016

server-54-192-195-246.iad53.r.cloudfront.net
February 4, 2016

server-54-192-195-204.iad53.r.cloudfront.net
February 4, 2016

server-54-192-195-202.iad53.r.cloudfront.net
February 4, 2016

server-54-192-195-182.iad53.r.cloudfront.net
February 4, 2016

File downloads found at URLs served by installercdn.filebulldog.com.

1 / 68      (Adware)
http://installercdn.filebulldog.com/.../bi_downloader.exe  (f317fa9b2fc85e63cb426964f0b0dfdf)

8 / 68      (PUP)
http://installercdn.filebulldog.com/.../bi_downloader.exe  (fb937dc853312f620080eff6ff25b9a3)

17 / 68    (Adware)
http://installercdn.filebulldog.com/.../bi_downloader.exe  (9b62c7540bfc4a4a68b2d7a20ee13af5)

The following 6 files have been seen to comunicate with installercdn.filebulldog.com in live environments.

URL:
http://installercdn.filebulldog.com/

Network:
Amazon Cloudfront

Web server:
nginx