home

speedfan.joydownload.com

Domains By Proxy, LLC  (Proxy Registrant)

Domain Information

The domain speedfan.joydownload.com is registered by proxy through GODADDY.COM, LLC and was originally registered in March of 2013. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Ashburn, Virginia within the United States which resides on the Amazon.com, Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform.
Registrar:
GODADDY.COM, LLC

Server location:
Virginia, United States (US)

Create date:
Monday, March 18, 2013

Expires date:
Saturday, March 18, 2017

Updated date:
Thursday, January 28, 2016

ASN:
AS14618 AMAZON-AES - Amazon.com, Inc.,US

Root domain:
joydownload.com

Whois:
2 joydownload.com records

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.InnovativeSystems.M, PUP.InnovativeSystems.Installer (M)
100.00%

McAfee
Artemis!A97AA4F99912, Artemis!1FC34F821322, Artemis!13724D897EC2, Artemis!2A2CC871B2C2
80.00%

Malwarebytes
PUP.Optional.OpenCandy
80.00%

Trend Micro House Call
Suspicious_GEN.F47V0715, Suspici.F184F561, Suspici.792C221A
80.00%

avast!
Win32:Adware-gen [Adw]
80.00%

Agnitum Outpost
Riskware.Agent
80.00%

Dr.Web
Adware.Downware.5295, Adware.Downware.6712, Adware.OpenCandy.55
80.00%

VIPRE Antivirus
Opencandy, Threat.4791855, Sevas-S Installer
80.00%

IKARUS anti.virus
PUA.JoyDownloader
80.00%

AVG
Generic, Adware AdLoad.OpenCandy
80.00%

NANO AntiVirus
Riskware.Win32.Downware.dejknq
60.00%

Sophos
Generic PUA IK
60.00%

Avira AntiVirus
APPL/Downloader.Gen
60.00%

G Data
Win32.Adware.OpenCandy
60.00%

Clam AntiVirus
Win.Trojan.Agent-803351
60.00%

The domain speedfan.joydownload.com has been seen to resolve to the following 9 IP addresses.

54.225.168.223
ec2-54-225-168-223.compute-1.amazonaws.com
April 11, 2016

50.19.96.56
ec2-50-19-96-56.compute-1.amazonaws.com
April 11, 2016

54.235.130.12
ec2-54-235-130-12.compute-1.amazonaws.com
June 26, 2015

23.23.159.111
ec2-23-23-159-111.compute-1.amazonaws.com
March 29, 2015

23.21.241.197
ec2-23-21-241-197.compute-1.amazonaws.com
March 29, 2015

107.22.254.230
ec2-107-22-254-230.compute-1.amazonaws.com
November 1, 2014

184.73.244.120
ec2-184-73-244-120.compute-1.amazonaws.com
November 1, 2014

23.23.108.120
ec2-23-23-108-120.compute-1.amazonaws.com
September 7, 2014

107.22.195.231
ec2-107-22-195-231.compute-1.amazonaws.com
September 7, 2014

File downloads found at URLs served by speedfan.joydownload.com.

18 / 68    (Adware)
http://speedfan.joydownload.com/get_file/wUiS4WnYccXBwj qXP7oQkEsm10kPj2gChOxatjZp7VvsTDsqSt4ytwEPwSnPe6oaSLi3VBGNmqSTqHyCr50ybtq1pneFQfS9SjyHgGu5i/gzLbDpZrSl2lZ9N1w2hcXRn3 AD9xlcMo/in8WWSSA7ZfwtWibmMVY A4LhNMOaz9RCMmLNzFZREghrPlFzQuO4/02/.../twxl5Vsdm0yBqkfKE2nSSsEYwdu5LvFSi3oZrTkC8qdfAaEZY2enUguvCmGh1zhVW61ddWV2jzDU75opD2xh0ucw==  (speedfan-4.49.exe)

1 / 68      (Adware)
http://speedfan.joydownload.com/get_file/wUia6yjQOMzI2m2zUbjxCgglkkU3Oj 1E1v4Y9bB87pi/269qGt42doJKlXsK7H6NWHpiBQBcDaeELCtGbE3xbhhwcOfDgfS9S74BlSj4Tj/16SY65uEg2gIq506kRYCASPzXG8rhshq9C3wSDXGHOgJitXqdD0EYqszKxwdOOz9UnBtLpeScwkpz6vlFSw3O8WnhLljXzentkTLleE5TMeve4GkbHtOnJjpD J9lRweroL h0qhN/.../Q==  (speedfan-4.49.exe)

18 / 68    (Adware)
http://speedfan.joydownload.com/get_azure_file/wUiS4WnYccXEwj 8WvauHEA0kxQ8PDK1GRz2cteQv A8/zyn9np5iNEMJ1XlbKn3fHm ykYHcXGHWOOgEqdwmuc0m4HeFQfS9S3yHgKzqnD8gfTbvNjKmiBBoJU6kQEbFzb7W3cw1p879WjwUmmLA/wJnZO3ZmkVY/.../yfOk1wnnyVZ4D88OlR3D35tnFiCdjbbVJV8RkbW0o8 ikFwhgixGi3J5OECbzRVSnsZG9zQ4ucw==  (speedfan-4.49.exe)

18 / 68    (Adware)
http://speedfan.joydownload.com/get_azure_file/wUiS4WnYccXBwj pXP7oQlssmVx1NTmnEgqmOZ T6bJ/qCeisGMxwdMEPwSnPe6oaSLi0l8bOGeGCb/ ROAlyPpqxcGXFU/RqnqsWheppX hj/zP 5GNg2gIq5Y6kRUbAGSsSTR2ntEo yzoUSCTRrZOnY hbnVSerJrJRkLMqj Xnl cM/FZREghrOgVjQuO4/z2/.../Mz4SXrjodfJzj4rJLxAT5Y8Pngxu6GtGxBz2Ensg4gGASeiDA75sZvgwx0ucw==  (speedfan-4.49.exe)

18 / 68    (Adware)
http://speedfan.joydownload.com/get_azure_file/wUiS4WnYccXEwj /.../8 k0wynKelnnG sAMVPrZ7vUXKwuZCb2SYkbaQVHNhoK3RguuOgFwgizkPlg4sVTTHlGAn6vc skh0ucw==  (speedfan-4.49.exe)

18 / 68    (Adware)
http://speedfan.joydownload.com/get_azure_file/wUiS4WnYccXBwj pXP7oQlssmVx1NTytCk6rPInBvqA87GL0sCsyno5aexa5db/iO3qilRwNIGjPEe tCuNon 01htSWRAaS9T35CELlszi1ivXbvI2B0iMX8Nx1wQlQXzWtAjRn14N8q3 sCz2LS/9Wy83zbm5TerJxJRoFIa3zRHE8csjENE5qzPimRzQuIY/.../h0qnLbh 1CahCd0at5nvHD6qoZrTkC8qdfYaEZY2enUguvCmGB1zhVW61ddWV2jzDU75opD2xh0ucw==  (speedfan-4.49.exe)

11 / 68    (Adware)
http://speedfan.joydownload.com/get_file/wUiS4WnYccXBwj qXP7oQkEsm10kPj2gChOxatrZp7Z rTy893p5ktEPKUfvYbL0OXO6yxdSNmmeTbD7Tac8gLNhw8yPREzEqnuuXRjqvGW7guuE5ozKmiBBo58i3BZQXzWtDTRn05p3qnS9GXGSA7ZfwtWibmMVY A4LhNMOaz9RCMmLNzFZREghrPlFzQuO4/w2/9xSnux8VDOlu1tFpn esGkfTcFi9O2XuMnlQ8U6o/.../Mz4SXrjoZCUnj4rJLxCRY4vbSZg8L72VF8j0gS7lNdMGT6iRlim98y1mR0ucw==  (speedfan-4.49.exe)

The following file have been seen to comunicate with speedfan.joydownload.com in live environments.

TCP » 23.21.241.197:80
install_flash_player-oc-jd.exe

URL:
http://speedfan.joydownload.com/

Title:
“SpeedFan - Download SpeedFan 4.5 in english on JoyDownload”

Description:
“Speedfan is a powerful tool for monitoring PC activities and capacity - Download SpeedFan latest version here.”

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
nginx/1.9.12 (PHP/5.3.10-1ubuntu3.21)

Facebook:
Shares:  10

Statistics are for the previous month.

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.