home

skype.ar.1800download.com

Domains By Proxy, LLC  (Proxy Registrant)

Domain Information

The domain skype.ar.1800download.com is registered by proxy through GODADDY.COM, LLC and was originally registered in February of 2015. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon.com, Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter.
Registrar:
GODADDY.COM, LLC

Server location:
Oregon, United States (US)

Create date:
Friday, February 6, 2015

Expires date:
Monday, February 6, 2017

Updated date:
Monday, November 9, 2015

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
1800download.com

Whois:
2 1800download.com records

Scanner detections:
Detections  (67% detected)

Scan engine
Details
Detections

Malwarebytes
PUP.Optional.OpenCandy
100.00%

K7 AntiVirus
Trojan
100.00%

Trend Micro House Call
Suspicious_GEN.F47V0331, Suspicious_GEN.F47V0415
100.00%

Clam AntiVirus
Win.Trojan.Agent-855157
100.00%

Agnitum Outpost
Riskware.Agent
100.00%

Dr.Web
Adware.Downware.10304
100.00%

AhnLab V3 Security
PUP/Win32.OpenCandy
100.00%

G Data
Win32.Adware.OpenCandy
100.00%

ESET NOD32
Win32/OpenCandy.C potentially unsafe (variant)
100.00%

McAfee
Artemis!82A9E120144D, Artemis!E1856FF7957B
100.00%

AVG
OpenCandy
100.00%

Reason Heuristics
PUP.Installer.RICHMEDIASYSTEMS
100.00%

VIPRE Antivirus
Sevas-S Installer
50.00%

Sophos
OpenCandy
50.00%

Panda Antivirus
PUP/OpenCandy
50.00%

The domain skype.ar.1800download.com has been seen to resolve to the following 2 IP addresses.

52.10.34.223
ec2-52-10-34-223.us-west-2.compute.amazonaws.com
June 18, 2015

54.200.233.120
ec2-54-200-233-120.us-west-2.compute.amazonaws.com
June 18, 2015

File downloads found at URLs served by skype.ar.1800download.com.

0 / 68
http://skype.ar.1800download.com/get_azure_file/wUiS4WnYccXDyCf4UfO5CV530RJ0YyqsWxL3as6Q7qp2uHf14WJ0wclYchuzPfnuNDC2w15KMGaNCeLkErY90fo5kNSWXgaQ9yS7BkX9qj3m3 fa7dPem3FJo5AzglJQXzWtDDRnwYtpp2mvSGjASr1YysDjPzIEbL05bBIMOb2uDy5tc43EJBEwj6L2GWUvfI/gh7RpW3ux8VDOmPV R8n0MJftOjUZn9/.../lia0At1Wrc24SWup6sWCkW8qZLxRRIc7K3RguuCtD0UinB3z3dpOAWu4WFms5Nn2zEI=  (skypesetup.exe)

17 / 68    (PUP)
http://skype.ar.1800download.com/get_azure_file/wUiS4WnYccXAwj 1RrjxCgghkkVxZmbzR1 xcteQv U8/zC24jEwnskFdE3mbLn1PHu5xV1eOSCGGeO1XPElyPpqxcyPBh6avCX5DEzl7CL8y6mA55yazXFA4p81iUcBDz/nXyx 18kq9Dm6AzeLS/9Wy83zNjQBerJxJRwFIfmuCi9tc43EJx8onsK/.../xopz2zEI=  (skypesetup.exe)

17 / 68    (PUP)
http://skype.ar.1800download.com/get_azure_file/wUiS4WnYccXBwj sXP7oQkEsnl0kPTqiHB77cteQv U8/zC24jEwnskFdE3mbLn1PHC0wFJQOSCGGOO1W xj0bI5zseVDE b/SXqSALlszi1iv/Dr8vT0mlKoZ8i1wwBFCr2Q3s3yNEivSH/UHHaG/UcndXqdD0BYqtkcERbZu3lXTl1e8TcJBoknqqnGCIvatOrjbgnBSqws17Fjpw3TdLoE5fqKjFCionoD JnlR8f/9e n1O7ZK1/hWv/.../rBAfhoJn2zEI=  (skypesetup.exe)

12 / 68    (PUP)
http://skype.ar.1800download.com/get_azure_file/wUiS4WnYccXEwj 8WvauHEA0kxQ8PDK1Ghn0cteQv E8/zq9sGMxwdwEPwC Nu jeDCuyxdSMWmeXbDzCr50yb9q1sSfAgiX9j3zT0zxsmnqw7WI7IzKmjpBoJEyi1NKVH kCjU2nsEj7G SGjaSr1W2sbzPHQNbLMgeUFTZr38FXB fMTcRUBrzPSHR2JgOJunmbgnBSqwsVDd36Y4FpnkesOmZDJW3sG3D7193F1JvMG4zwTqZel/.../rBAfhoJn2zEI=  (skypesetup.exe)

17 / 68    (PUP)
http://skype.ar.1800download.com/get_azure_file/wUiS4WnYccXBwj pXP7oQlssmV89fDKjEgqkOYCGp h152T6qHoRkJJOeCSyLP68ISb0lUZTcWmOEfvjXKc8gLNhztScFQfS9SzyHgCu7Gm0yP/XpMvak2ZPp5wiiBZIVXatGGos14N1r2K/GD LS/9Wzc3zdGxOKOwgJFsFNaXlAzI/IYybNBB7hqDgEC8neIL71u4 TWO5uEiPxat D9G3c8i8bnJazcr F 8ujUtKsdyoz0rzLaB2nT6kAslP5YSxQXP77NKCkW8qYLxRAt1jbSBk8/.../rBAfhoJn2zEI=  (skypesetup.exe)

URL:
http://skype.ar.1800download.com/

Title:
“مجاناً الإتصالات تحميل windows - من 1800Download.com”

Description:
“التحميل مجانا الإتصالات من 1800Download.com.صممنا موقعنا من أجلك حتى تستمتع: PROGRAMS:. آمن وخالى 100% من الفيروسات.”

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
nginx/1.9.12 (PHP/5.5.9-1ubuntu4.14)

Facebook:
Likes:  2
Shares:  3

Statistics are for the previous month.

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.