home

soft.mgyun.com

Domain Whois Privacy Protection Service

Domain Information

The domain soft.mgyun.com registered by Domain Whois Privacy Protection Service was initially registered in August of 2011 through SHANGHAI MEICHENG TECHNOLOGY INFORMATION DEVELOPMENT CO., LTD.. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Zhengzhou, Henan within China which resides on the Asia Pacific Network Information Centre network.
Registrar:
SHANGHAI MEICHENG TECHNOLOGY INFORMATION DEVELOPMENT CO., LTD.

Server location:
Henan, China (CN)

Create date:
Sunday, August 14, 2011

Expires date:
Sunday, August 14, 2016

Updated date:
Monday, August 3, 2015

Root domain:
mgyun.com

Whois:
4 mgyun.com records

Google Safe Browsing:
malware

Scanner detections:
Detections  (59% detected)

Scan engine
Details
Detections

avast!
Win32:AgentDropper-A [PUP], Android:Agent-CTH [PUP], Android:Agent-CRI [PUP], Android:Agent-FUC [PUP], Android:Agent-GYN [PUP]
95.45%

ESET NOD32
Android/Spy.Agent.BN (variant), Android/KingRoot, Android/KingRoot.C potentially unsafe (variant), Android/Spy.Agent.BK (variant)
90.91%

NANO AntiVirus
Trojan.Dex.Rooter.daolwi, Trojan.Android.Rooter.daolwi, Trojan.Android.Doll.dindue, Riskware.Android.Rooter.daolwi, Trojan.Android.Coogos.dspuwx
86.36%

McAfee
Artemis!CDAB97A24E5E, Artemis!5E753A38CD14, Artemis!9F5A153527F3, Artemis!1A74F80213F6, Artemis!780B71754FAF, Artemis!7A4E069F5F7C, Artemis!89944F602C21, Artemis!9241BD3E6097, Artemis!E8AE4EB27F2C, Artemis!F0499B8FD1E6, Artemis!58C2F8AD1563, Trojan.Artemis!7B9CA67CF8B2
77.27%

Avira AntiVirus
Android/Spy.Agent.U.Gen, Android/Spy.Agent.Y.Gen, Android/Spy.Agent.BD.Gen, Android/Spy.Agent.GJ.Gen, ADWARE/ANDR.Waps.MS.Gen
68.18%

Fortinet FortiGate
Android/Agent.BN!tr.spy, Adware/KingRoot, Adware/Waps!Android, Android/Agent.PI!tr.spy
63.64%

Lavasoft Ad-Aware
Android.Riskware.Agent.gXWSX, Android.Hacktool.Mgyun.B, Android.Hacktool.Mgyun.A, Android.Riskware.Kingroot.C, Android.Riskware.Agent.gXWXY
54.55%

Comodo Security
UnclassifiedMalware
50.00%

AVG
Android/Deng, Android/KingRoot, Android/G2P.CN.1A9150309ABB
50.00%

Trend Micro House Call
TROJ_GEN.F47V0310, TROJ_GEN.F47V0512, TROJ_GEN.F47V0520, Suspicious_GEN.F47V0619, Suspicious_GEN.F47V0816, Suspicious_GEN.F47V1223
45.45%

IKARUS anti.virus
Trojan.AndroidOS.Agent, PUA.AndroidOS.Waps, PUA.AndroidOS.Mgyun
45.45%

K7 AntiVirus
Spyware , Trojan
36.36%

F-Secure
Android.Riskware.Agent.gXWSX, Android.Hacktool.Mgyun.B, Android.Hacktool.Mgyun.A, Android.Riskware.Kingroot.C
31.82%

Dr.Web
Android.Spy.82.origin, infected with Android.Spy.144.origin
27.27%

Sophos
Mal/Generic-S, PUA 'Android MgyunRoot' (of type Hacktool)
27.27%

The domain soft.mgyun.com has been seen to resolve to the following 68 IP addresses.

104.96.220.161
a104-96-220-161.deploy.static.akamaitechnologies.com
August 24, 2016

65.158.47.17
August 6, 2016

65.158.47.27
August 6, 2016

104.96.220.171
a104-96-220-171.deploy.static.akamaitechnologies.com
May 20, 2016

104.96.220.137
a104-96-220-137.deploy.static.akamaitechnologies.com
May 20, 2016

23.62.6.194
a23-62-6-194.deploy.static.akamaitechnologies.com
April 12, 2016

23.62.6.192
a23-62-6-192.deploy.static.akamaitechnologies.com
April 12, 2016

23.0.160.88
a23-0-160-88.deploy.static.akamaitechnologies.com
February 19, 2016

23.0.160.96
a23-0-160-96.deploy.static.akamaitechnologies.com
February 19, 2016

23.220.148.8
a23-220-148-8.deploy.static.akamaitechnologies.com
December 26, 2015

23.220.148.58
a23-220-148-58.deploy.static.akamaitechnologies.com
December 26, 2015

23.3.13.235
a23-3-13-235.deploy.static.akamaitechnologies.com
November 7, 2015

23.3.13.187
a23-3-13-187.deploy.static.akamaitechnologies.com
November 7, 2015

23.0.160.27
a23-0-160-27.deploy.static.akamaitechnologies.com
October 29, 2015

23.0.160.66
a23-0-160-66.deploy.static.akamaitechnologies.com
October 29, 2015

103.7.30.195
July 7, 2015

103.7.30.217
July 7, 2015

103.7.30.215
July 7, 2015

103.7.30.214
July 7, 2015

103.7.30.213
July 7, 2015

103.7.30.212
July 7, 2015

184.105.206.113
May 3, 2015

211.90.30.29
December 2, 2014

211.90.30.18
December 2, 2014

221.194.184.197
December 1, 2014

218.60.107.19
cncln.online.ln.cn
December 1, 2014

211.90.30.22
December 1, 2014

139.209.89.83
83.89.209.139.adsl-pool.jlccptt.net.cn
December 1, 2014

139.209.89.82
82.89.209.139.adsl-pool.jlccptt.net.cn
December 1, 2014

183.232.26.147
September 3, 2014

 
Showing 30 of 68 IP Addresses

File downloads found at URLs served by soft.mgyun.com.

0 / 68
http://soft.mgyun.com/files/products/romastersu/1015/2016/.../RomasterSu_3.2.3_160728T1703_1015_r.apk  (7c6379d1a6bba71bee42d10c667a2589)

0 / 68
http://soft.mgyun.com/files/products/vRoot/1015/2016/.../VRoot_1.8.8.20457_cid1015_923c8190.exe  (iroot_1.8.8.20457_cid1005_7337ba1e.exe)

0 / 68
http://soft.mgyun.com/files/products/romastersu/1015/2016/.../RomasterSu_3.2.2_160623T1404_1015_r.apk  (1fdb7fa9-2a7f-412e-4a2a-e233c238dfff_1d1db5d10b87ab0)

0 / 68
http://soft.mgyun.com/files/products/vRoot/1005/2016/.../iRoot_1.8.7.20375_cid1005_7337ba1e.exe  (bbca75949495602376344a1e1079307e)

13 / 68    (PUP)
http://soft.mgyun.com/files/products/vRoot/1000/2014/.../VRoot_1.7.9.11674_Setup.exe  (vroot_1896286464_cid1000_7ba70783.exe)

0 / 68
http://soft.mgyun.com/files/products/vRoot/1000/2016/.../VRoot_1.8.8.20396_Setup.exe  (vroot_1.8.8.20396_cid2040_44c47ecb.exe)

11 / 68    (PUP)
http://soft.mgyun.com/files/products/vRoot/1005/2015/.../iRoot_1.8.5_cid1005_7337ba1e.exe  (58c2f8ad1563403f8f352b606ab811f2)

0 / 68
http://soft.mgyun.com/files/products/vRoot/2040/2016/.../VRoot_1.8.7.20375_cid2040_44c47ecb.exe  (vroot_1.8.7.20375_setup.exe)

0 / 68
http://soft.mgyun.com/files/products/vRoot/1000/2016/.../VRoot_1.8.7.20375_Setup.exe  (aee013b28456f1f78da52c1df0d35ac1)

5 / 68      (PUP)
http://soft.mgyun.com/files/products/vRoot/1000/2015/.../VRoot_1.8.6.19461_Setup.exe  (iroot_1.8.6.19461_cid1005_7337ba1e.exe)

0 / 68
http://soft.mgyun.com/files/products/vRoot/1000/2016/.../VRoot_1.8.7.20299_Setup.exe  (67752d2de2f7c2d2a45478fe79ce287c)

0 / 68
http://soft.mgyun.com/files/products/vRoot/1005/2014/.../iRoot_1.7.9.10454_cid1005_7337ba1e.exe  (9a7d4ceb15509cb3fdf02cdb1df994a0)

8 / 68      (PUP)
http://soft.mgyun.com/files/products/vRoot/1000/2015/.../VRoot_1.8.5.15288_Setup.exe  (3981980a9743d3b0fa8345a31c103399)

7 / 68      (PUP)
http://soft.mgyun.com/files/products/vRoot/1000/2016/.../VRoot_1.8.6.20013_Setup.exe  (vroot_1896351234.exe)

11 / 68    (PUP)
http://soft.mgyun.com/files/products/vRoot/1005/2015/.../iRoot_1.8.6.19460_cid1005_7337ba1e.exe  (vroot_1896351232_cid1005_7337ba1e.exe)

14 / 68    (PUP)
http://soft.mgyun.com/files/products/romastersu/2075/2015/.../RomasterSu_2.2.8_151222_2075.apk  (45ef2d1f2ea652827fdcb15859f07317)

22 / 68    (PUP)
http://soft.mgyun.com/files/products/romastersu/2075/2015/.../RomasterSu_2.2.1_150514_2075.apk  (579378729ca1f135a8263c93dda69895)

7 / 68      (PUP)
http://soft.mgyun.com/files/products/vRoot/1005/2015/.../iRoot_1.8.5.15285_cid1005_7337ba1e.exe  (f59d89a2dac8d156b5f14fcd25493cdd)

0 / 68
http://soft.mgyun.com/files/products/vRoot/1000/2015/.../VRoot_1.8.5.15285_Setup.exe  (27f95cc82ededb4d09daffd052d4b6d6)

13 / 68    (PUP)
http://soft.mgyun.com/files/products/romasterlab/1000/2015/.../Romaster_4.0.8.13135_Setup.exe  (romaster_67110912_cid1000_7ba70783.exe)

11 / 68    (PUP)
http://soft.mgyun.com/files/products/vRoot/1000/2015/.../VRoot_1.8.2.13135_Setup.exe  (vroot_1896350208_cid1000_7ba70783.exe)

10 / 68    (PUP)
http://soft.mgyun.com/files/products/vRoot/1000/2015/.../VRoot_1.8.0.12451_Setup.exe  (vroot_1896349696_cid1000_7ba70783.exe)

8 / 68      (PUP)
http://soft.mgyun.com/files/products/romasterlab/1000/2014/.../Romaster_3.4.9.9512_Setup.exe  (4853fd6c2e3f8bf56dd1d57378c7c4f0)

11 / 68    (PUP)
http://soft.mgyun.com/files/products/vRoot/1000/2014/.../VRoot_1.7.9.10344_Setup.exe  (vroot_1896286464.exe)

7 / 68      (Malware)
http://soft.mgyun.com/files/products/romasterlab/1000/2014/.../Romaster_3.3.9.5591_Setup (1).exe  (romaster_50530560.exe)

9 / 68      (PUP)
http://soft.mgyun.com/files/products/vRoot/1000/2014/.../VRoot_1.7.8.8589_Setup.exe  (vroot_1896286208_cid1000_7ba70783.exe)

10 / 68    (PUP)
http://soft.mgyun.com/files/products/vRoot/1000/2014/.../VRoot_1.7.8.8987_Setup.exe  (vroot_1896286208.exe)

11 / 68    (PUP)
http://soft.mgyun.com/files/products/vRoot/1000/2014/.../VRoot_1.7.8.7753_Setup.exe  (vroot_1896286208.exe)

8 / 68      (PUP)
http://soft.mgyun.com/files/products/vRoot/1000/2014/.../VRoot_1.7.7.7592_Setup.exe  (780b71754fafc01e9ce680e707839760)

7 / 68      (PUP)
http://soft.mgyun.com/files/products/vRoot/1000/2014/.../VRoot_1.7.6.7026_Setup.exe  (9f5a153527f35efbcb403059e0adc9e5)

 
Latest 30 of 39 download URLs

The following 102 files have been seen to comunicate with soft.mgyun.com in live environments.

TCP » 104.96.220.137:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 104.96.220.137:443
browser.exe (Browser)

TCP » 104.96.220.161:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 104.96.220.161:443
kometa.exe (Kometa by Kometa Authors)

TCP » 104.96.220.137:80
browser.exe (Browser)

TCP » 104.96.220.161:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 104.96.220.171:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 23.62.6.194:80
browser.exe (Browser)

TCP » 23.62.6.192:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 23.62.6.192:443
kometa.exe (Kometa by Kometa Authors)

TCP » 122.143.24.84:80
wpsupdate.exe (WPS Office by Zhuhai Kingsoft Office Software Co.,Ltd)

TCP » 104.96.220.137:80
jkeklmkkcakahbnneopcfballlgclcan.crx

TCP » 104.96.220.137:80
gjhenfjalnkjdiploladgjmejijdpkhd.crx

TCP » 104.96.220.137:80
onheklgeghhphlhgpbfpgmlpjinjoida.crx

TCP » 104.96.220.137:80
khdemibhikiomfgglllekcpbbhgbljgk.crx

TCP » 104.96.220.137:80
khdemibhikiomfgglllekcpbbhgbljgk.crx

TCP » 104.96.220.137:80
jkeklmkkcakahbnneopcfballlgclcan.crx

TCP » 104.96.220.137:80
dojomgbpinbfnmmlbnehdmohanicflei.crx

TCP » 104.96.220.137:80
jcjikekeilbpkoifdabkmohhfgklpidn.crx

TCP » 104.96.220.137:80
pfmhihbhjoaodjeflckgblflnhgghpai.crx

 
Latest 20 of 112 files

URL:
http://soft.mgyun.com/

Web server:
nginx/1.6.3

Facebook:
Shares:  6

Statistics are for the previous month.

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.