home

sub.elequentking.com

Joseph Davidson

Domain Information

The domain sub.elequentking.com registered by Joseph Davidson was initially registered in May of 2015 through GANDI SAS. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Dulles, Virginia within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Cloudfront CDN service which utilizes a number of proxy IP Addresses (see below).
Registrar:
GANDI SAS

Server location:
Virginia, United States (US)

Create date:
Monday, May 11, 2015

Expires date:
Thursday, May 11, 2017

Updated date:
Wednesday, April 6, 2016

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
elequentking.com

Whois:
2 elequentking.com records

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
Threat.Somoto.Installer, PUP.Installer.SITEONSPOT, PUP.Somoto.Bundler, PUP.Somoto.SiteonSpot.Bundler (M), PUP.Somoto.SITEONSPOT.Bundler (M), PUP.Somoto.SITEONSP.Bundler (M), PUP.Somoto.SiteonSp.Bundler (M)
100.00%

VIPRE Antivirus
Threat.4150696, Trojan.Win32.Generic
19.23%

Dr.Web
Adware.Somoto.131, Trojan.Packed.28357
19.23%

Kaspersky
not-a-virus:Downloader.Win32.Somato, not-a-virus:Downloader.NSIS.Mazel
19.23%

AVG
Potentially harmful program Downloader.DFF, AdLoad.S
19.23%

Bkav FE
W32.HfsAdware
19.23%

MicroWorld eScan
Application.Bundler.Somoto.AG
19.23%

Bitdefender
Application.Bundler.Somoto.AG
19.23%

K7 AntiVirus
Unwanted-Program , Trojan
19.23%

NANO AntiVirus
Trojan.Nsis.Downloader.dpxxrf
19.23%

F-Secure
Application.Bundler.Somoto
19.23%

Baidu Antivirus
Adware.Win32.Somoto
19.23%

Qihoo 360 Security
Win32/Virus.Downloader.912, Win32/Virus.099
19.23%

Malwarebytes
PUP.Optional.Somoto.SID.A
15.38%

AhnLab V3 Security
PUP/Win32.Somoto, Win-PUP/Somoto
15.38%

The domain sub.elequentking.com has been seen to resolve to the following 114 IP addresses.

52.85.131.130
server-52-85-131-130.iad53.r.cloudfront.net
July 23, 2016

52.85.131.106
server-52-85-131-106.iad53.r.cloudfront.net
July 23, 2016

52.85.131.38
server-52-85-131-38.iad53.r.cloudfront.net
July 23, 2016

52.85.131.22
server-52-85-131-22.iad53.r.cloudfront.net
July 23, 2016

52.85.131.14
server-52-85-131-14.iad53.r.cloudfront.net
July 23, 2016

52.85.131.230
server-52-85-131-230.iad53.r.cloudfront.net
July 23, 2016

52.85.131.158
server-52-85-131-158.iad53.r.cloudfront.net
July 23, 2016

52.85.131.156
server-52-85-131-156.iad53.r.cloudfront.net
July 23, 2016

52.85.131.33
server-52-85-131-33.iad53.r.cloudfront.net
July 6, 2016

52.85.131.244
server-52-85-131-244.iad53.r.cloudfront.net
July 6, 2016

52.85.131.184
server-52-85-131-184.iad53.r.cloudfront.net
July 6, 2016

52.85.131.180
server-52-85-131-180.iad53.r.cloudfront.net
July 6, 2016

52.85.131.168
server-52-85-131-168.iad53.r.cloudfront.net
July 6, 2016

52.85.131.150
server-52-85-131-150.iad53.r.cloudfront.net
July 6, 2016

52.85.131.74
server-52-85-131-74.iad53.r.cloudfront.net
July 6, 2016

52.85.131.55
server-52-85-131-55.iad53.r.cloudfront.net
July 6, 2016

52.84.125.119
server-52-84-125-119.iad16.r.cloudfront.net
July 6, 2016

52.84.125.109
server-52-84-125-109.iad16.r.cloudfront.net
July 6, 2016

52.84.125.91
server-52-84-125-91.iad16.r.cloudfront.net
July 6, 2016

52.84.125.75
server-52-84-125-75.iad16.r.cloudfront.net
July 6, 2016

52.84.125.74
server-52-84-125-74.iad16.r.cloudfront.net
July 6, 2016

52.84.125.14
server-52-84-125-14.iad16.r.cloudfront.net
July 6, 2016

52.84.125.184
server-52-84-125-184.iad16.r.cloudfront.net
July 6, 2016

52.84.125.150
server-52-84-125-150.iad16.r.cloudfront.net
July 6, 2016

52.85.142.178
server-52-85-142-178.iad12.r.cloudfront.net
May 27, 2016

52.85.142.127
server-52-85-142-127.iad12.r.cloudfront.net
May 27, 2016

52.85.142.70
server-52-85-142-70.iad12.r.cloudfront.net
May 27, 2016

52.84.125.172
server-52-84-125-172.iad16.r.cloudfront.net
May 26, 2016

52.84.125.168
server-52-84-125-168.iad16.r.cloudfront.net
May 26, 2016

52.84.125.132
server-52-84-125-132.iad16.r.cloudfront.net
May 26, 2016

 
Showing 30 of 114 IP Addresses

File downloads found at URLs served by sub.elequentking.com.

17 / 68    (Adware)
http://sub.elequentking.com/installers/bi_downloader/.../setup.exe  (nsr4e16.tmp)

1 / 68      (Adware)
http://sub.elequentking.com/installers/bi_downloader/.../setup.exe  (687b410cb0a6652525cc7d286e6189ba)

1 / 68      (Adware)
http://sub.elequentking.com/installers/bi_downloader/.../setup.exe  (nsqdeb8.tmp)

20 / 68    (Adware)
http://sub.elequentking.com/installers/bi_downloader/.../setup.exe  (nst39cf.tmp)

1 / 68      (Adware)
http://sub.elequentking.com/installers/bi_downloader/.../setup.exe  (nsneb83.tmp)

22 / 68    (Adware)
http://sub.elequentking.com/installers/bi_downloader/.../setup.exe  (nshacc6.tmp)

1 / 68      (Adware)
http://sub.elequentking.com/installers/bi_downloader/.../setup.exe  (nstce7c.tmp)

1 / 68      (Adware)
http://sub.elequentking.com/installers/bi_downloader/.../setup.exe  (nsfdbf8.tmp)

1 / 68      (Adware)
http://sub.elequentking.com/installers/bi_downloader/.../setup.exe  (nsp8e2c.tmp)

1 / 68      (Adware)
http://sub.elequentking.com/installers/bi_downloader/.../setup.exe  (nsvb7c6.tmp)

1 / 68      (Adware)
http://sub.elequentking.com/installers/bi_downloader/.../setup.exe  (nsjfa63.tmp)

1 / 68      (Adware)
http://sub.elequentking.com/installers/bi_downloader/.../setup.exe  (nsybdc2.tmp)

1 / 68      (Adware)
http://sub.elequentking.com/installers/bi_downloader/.../setup.exe  (nscb819.tmp)

23 / 68    (Adware)
http://sub.elequentking.com/installers/bi_downloader/.../setup.exe  (nsh42ae.tmp)

1 / 68      (Adware)
http://sub.elequentking.com/installers/bi_downloader/.../setup.exe  (nsx9023.tmp)

1 / 68      (Adware)
http://sub.elequentking.com/installers/bi_downloader/.../setup.exe  (nsx9a0e.tmp)

1 / 68      (Adware)
http://sub.elequentking.com/installers/bi_downloader/.../setup.exe  (3e7ad5ca1ef9d942741b620422abc02f)

18 / 68    (Adware)
http://sub.elequentking.com/installers/bi_downloader/.../setup.exe  (nss78f.tmp)

1 / 68      (Adware)
http://sub.elequentking.com/installers/bi_downloader/.../setup.exe  (nss7818.tmp)

1 / 68      (Adware)
http://sub.elequentking.com/installers/bi_downloader/.../setup.exe  (nsh3c4e.tmp)

1 / 68      (Adware)
http://sub.elequentking.com/installers/bi_downloader/.../setup.exe  (4d8fb7b2d530d38d2625aabada35560c)

1 / 68      (Adware)
http://sub.elequentking.com/installers/bi_downloader/.../setup.exe  (d361f3c65b866f4e1a28c06feaf1af85)

1 / 68      (Adware)
http://sub.elequentking.com/installers/bi_downloader/.../setup.exe  (nska9eb.tmp)

1 / 68      (Adware)
http://sub.elequentking.com/installers/bi_downloader/.../setup.exe  (nsze426.tmp)

1 / 68      (Adware)
http://sub.elequentking.com/installers/bi_downloader/.../setup.exe  (nshdfac.tmp)

1 / 68      (Adware)
http://sub.elequentking.com/installers/bi_downloader/.../setup.exe  (nsn95eb.tmp)

The following 60 files have been seen to comunicate with sub.elequentking.com in live environments.

TCP » 52.85.142.32:443
browserairexec.exe (BrowserAir by Goobzo)

TCP » 52.84.125.75:80
browser.exe (speed browser by Smart Applications)

TCP » 52.85.142.178:443
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.85.142.144:443
jingling.exe

TCP » 52.85.142.154:80
GPlayer.exe (by Exent Technologies)

TCP » 52.85.131.252:443
browser.exe (Browser)

TCP » 52.85.142.220:443
browserairexec.exe (BrowserAir by Goobzo)

TCP » 52.85.142.145:443
ManyCam.exe (ManyCam Virtual Webcam by Visicom Media)

TCP » 52.84.125.74:443
browser.exe (Browser)

TCP » 52.85.142.183:80
jingling.exe

TCP » 52.84.125.150:80
se.exe

TCP » 52.84.125.14:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.85.142.145:80
browser.exe (Browser)

TCP » 52.85.142.154:443
whatsapptime.exe

TCP » 52.85.142.59:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.85.142.70:443
clearscreenplayerbrowser.exe

TCP » 52.84.125.52:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.84.125.14:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.85.131.106:443
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.85.142.127:443
UCBrowser.exe (UC Browser by UCWeb)

 
Latest 20 of 158 files

URL:
http://sub.elequentking.com/

Network:
Amazon Cloudfront

Web server:
nginx

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.