home

sub.goveba.info

Bill Stanbrook

Domain Information

This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Dulles, Virginia within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Cloudfront CDN service which utilizes a number of proxy IP Addresses (see below).
Registrar:
GoDaddy.com, LLC

Server location:
Virginia, United States (US)

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
goveba.info

Whois:
2 goveba.info records

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Bundler.Somoto, PUP.Somoto.Bundler, PUP.Somoto.SiteonSpot.Bundler (M), Adware.Somoto.Installer.Meta (M), PUP.Somoto.SiteonSp.Bundler (M), Adware.Somoto (M)
95.74%

AVG
Potentially harmful program Downloader.DTV, AdLoad.R
17.02%

Baidu Antivirus
Adware.Win32.Somoto
17.02%

Panda Antivirus
Trj/Genetic.gen, Trj/CI.A
17.02%

VIPRE Antivirus
Threat.4150696, Trojan.Win32.Generic
14.89%

Dr.Web
Adware.Somoto.131, Adware.Somoto.128, Threat.Undefined
14.89%

Quick Heal
Adware.NSIS.BetterInstaller.A
14.89%

K7 AntiVirus
Trojan
14.89%

NANO AntiVirus
Riskware.Nsis.Adware.dpwuzb, Trojan.Win32.Agent.dtledk
14.89%

Clam AntiVirus
Win.Adware.Somoto
14.89%

Kaspersky
not-a-virus:Downloader.Win32.Somato, not-a-virus:Downloader.NSIS.AdLoad
14.89%

Qihoo 360 Security
HEUR/QVM42.0.Malware.Gen, HEUR/QVM42.1.Malware.Gen, Win32/Virus.Downloader.912, Win32/Virus.Downloader.78b
10.64%

Bkav FE
W32.HfsAdware
8.51%

Trend Micro House Call
TROJ_GEN.R0C1H07DI15, TROJ_GEN.R08NH07DI15, TROJ_GEN.F0C2C00CO15, TROJ_GEN.R00GH07DN15
8.51%

AhnLab V3 Security
PUP/Win32.Somoto
8.51%

The domain sub.goveba.info has been seen to resolve to the following 26 IP addresses.

50.63.202.41
ip-50-63-202-41.ip.secureserver.net
May 17, 2016

108.167.189.78
gator4252.hostgator.com
April 4, 2016

54.240.160.95
server-54-240-160-95.iad12.r.cloudfront.net
August 11, 2015

54.240.160.93
server-54-240-160-93.iad12.r.cloudfront.net
August 11, 2015

54.240.160.43
server-54-240-160-43.iad12.r.cloudfront.net
August 11, 2015

54.240.160.34
server-54-240-160-34.iad12.r.cloudfront.net
August 11, 2015

54.240.160.28
server-54-240-160-28.iad12.r.cloudfront.net
August 11, 2015

54.240.160.200
server-54-240-160-200.iad12.r.cloudfront.net
August 11, 2015

54.240.160.180
server-54-240-160-180.iad12.r.cloudfront.net
August 11, 2015

54.240.160.112
server-54-240-160-112.iad12.r.cloudfront.net
August 11, 2015

54.230.193.149
server-54-230-193-149.iad53.r.cloudfront.net
July 1, 2015

54.230.192.9
server-54-230-192-9.iad53.r.cloudfront.net
July 1, 2015

54.192.194.222
server-54-192-194-222.iad53.r.cloudfront.net
July 1, 2015

54.192.194.33
server-54-192-194-33.iad53.r.cloudfront.net
July 1, 2015

54.192.192.10
server-54-192-192-10.iad53.r.cloudfront.net
July 1, 2015

54.239.152.145
server-54-239-152-145.iad53.r.cloudfront.net
July 1, 2015

54.239.152.78
server-54-239-152-78.iad53.r.cloudfront.net
July 1, 2015

54.230.195.119
server-54-230-195-119.iad53.r.cloudfront.net
July 1, 2015

54.192.55.178
server-54-192-55-178.jfk6.r.cloudfront.net
May 5, 2015

54.192.55.192
server-54-192-55-192.jfk6.r.cloudfront.net
May 5, 2015

54.230.53.79
server-54-230-53-79.jfk6.r.cloudfront.net
May 5, 2015

54.230.52.105
server-54-230-52-105.jfk6.r.cloudfront.net
May 5, 2015

54.230.52.158
server-54-230-52-158.jfk6.r.cloudfront.net
May 5, 2015

54.230.52.85
server-54-230-52-85.jfk6.r.cloudfront.net
May 5, 2015

54.192.55.134
server-54-192-55-134.jfk6.r.cloudfront.net
May 5, 2015

54.230.52.95
server-54-230-52-95.jfk6.r.cloudfront.net
May 5, 2015

File downloads found at URLs served by sub.goveba.info.

1 / 68      (PUP)
http://sub.goveba.info/Nds5jhv2za33e9af5d48d196d11d5f8a089d5617609rvVQcM444YToyOntzOjI6InRzIjtpOjE0MjkyNjc0Mzc7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQyOTE0OTg1MzIxMS5leGUiO30=  (filedownloaded20successfully_downloader-nds5jhv2z.exe)

16 / 68    (PUP)
http://sub.goveba.info/N5KvYPFuK684ee3d67f632d0988c29abc4c1f73da0PkoR1LrJkSYToyOntzOjI6InRzIjtpOjE0MjkyNDcyNDI7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQyOTEzNTQ1NDEzMy5leGUiO30=  (flvplayer_downloader-n3olwe7ml.exe)

1 / 68      (Adware)
http://sub.goveba.info/Q3fnVwCdG8416320046325cd4f8e37efb38deb0500GGXW3ngyxoYToyOntzOjI6InRzIjtpOjE0Mjk0NzExMzY7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQyOTQ3MDA4NjMyOS5leGUiO30=  (_cd_desejo_de_menina_vol_9_2014_downloader-q3fnvwcdg.exe)

1 / 68      (Adware)
http://sub.goveba.info/QcilCSZPV7a61601faea868aa0d5959f9d39567e60Y8Jv7HvQJZYToyOntzOjI6InRzIjtpOjE0MjkzODk3MDc7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQyOTM4NzM4NTkzNS5leGUiO30=  (microsoft_office_2010_pt_br_x86_completo_ativador_via_via_filmes_games_musicas_programas_downloader-)

1 / 68      (Adware)
http://sub.goveba.info/QdYvQPUnEe4ab2f4f3ed26d9379d0be21c53caf6f0dDLuffe3RlYToyOntzOjI6InRzIjtpOjE0MjkyNDYzNjM7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQyOTI0MzMzNTg1OS5leGUiO30=  (freedownloadpdfkeexcelconverterterbaru2013fullversion_downloader-nc0nhrbx1.exe)

1 / 68      (PUP)
http://sub.goveba.info/N2yeDlsFy2d691e4f606d00ff1bd7094bef14d7fd090jm9LnGHuYToyOntzOjI6InRzIjtpOjE0Mjk0NTU2Njc7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQyOTMwMDk4MTI0OS5leGUiO30=  (filedownloaded20successfully_downloader-n2yedlsfy.exe)

1 / 68      (PUP)
http://sub.goveba.info/N46knnhtIc19c8519aacd562186fe1dab8bfe01380eEhwZS208EYToyOntzOjI6InRzIjtpOjE0MjkzNTgyOTI7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQyOTIwMzc4MTgzNS5leGUiO30=  (flvplayer_downloader-n46knnhti.exe)

1 / 68      (Adware)
http://sub.goveba.info/N0MHfdFtkb1b43b037ff825423e27334d9c2881660JHpOLoY2a1YToyOntzOjI6InRzIjtpOjE0Mjk0NzI2NjE7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQyOTQ3MDA5MDc5Mi5leGUiO30=  (flvplayer_downloader-ndyialiy6.exe)

1 / 68      (PUP)
http://sub.goveba.info/N9XBJyody701150128991a069b91ac97aa12014a90HJzPDxv2rGYToyOntzOjI6InRzIjtpOjE0Mjk0MTEyOTg7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQyOTMyOTc0MTU0Ni5leGUiO30=  (filedownloaded20successfully_downloader-n9xbjyody.exe)

1 / 68      (PUP)
http://sub.goveba.info/N179gFPmR878f15d6009e46f30bccb84eb921279e0cqh5hJJbgtYToyOntzOjI6InRzIjtpOjE0MjkzNzEzMzE7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQyOTIxODE0MTIxNy5leGUiO30=  (filedownloaded20successfully_downloader-n179gfpmr.exe)

1 / 68      (Adware)
http://sub.goveba.info/Q0knQOPnUc58dfe1dc54f2770dea97f39f4f7d6b00eegysE2kRHYToyOntzOjI6InRzIjtpOjE0MjkzNzcwNzE7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQyOTM3NjYwMTUzOC5leGUiO30=  (dying_light_dublado_ptbr_downloader-q0knqopnu.exe)

1 / 68      (Adware)
http://sub.goveba.info/N0tYfPLkc59315b4eac5bcbcb97dec976ad876dbb0U75p6dHFgoYToyOntzOjI6InRzIjtpOjE0MjkyNTQ2NTU7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQyOTI1NDE5NjE1NC5leGUiO30=  (flvplayer_downloader-n0tyfplkc.exe)

1 / 68      (Adware)
http://sub.goveba.info/Q9Fn9Kegw11e7242de9540a7b9632d1b7ed5e3a5907qjERqMFUIYToyOntzOjI6InRzIjtpOjE0MjkyOTc3NTI7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQyOTI5NzM4OTA1NC5leGUiO30=  (windows_7_todas_as_versoes_em_portugues_br_32_64_bits_completo_full_ph_downs_downloader-q9fn9kegw.ex)

1 / 68      (Adware)
http://sub.goveba.info/Q1g61FFz0eedb7e9d33530e7e437c036ca6a469d90Vil2ut2LuKYToyOntzOjI6InRzIjtpOjE0MjkyOTc4OTU7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQyOTI5NzM5MzUwNy5leGUiO30=  (fastandfurious7frenchdvdrip2015_downloader-nekikfyc4.exe)

1 / 68      (Adware)
http://sub.goveba.info/NcyCmEGDw5833601e7eddd85a6f88070bb0b9e50e0YK1Ai7I1YoYToyOntzOjI6InRzIjtpOjE0MjkzODgxNjQ7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQyOTM4NzM4MTcxMy5leGUiO30=  (idmterbaru6_downloader-ncycmegdw.exe)

1 / 68      (PUP)
http://sub.goveba.info/N2qyWZlu80d813bfee3501fbb0dc63ba8c1978ee306gGuc0mjO8YToyOntzOjI6InRzIjtpOjE0MjkyODAwOTQ7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQyOTE4NTgzNzk1Mi5leGUiO30=  (filedownloaded20successfully_downloader-n2qywzlu8.exe)

1 / 68      (Adware)
http://sub.goveba.info/Q9wsXHlsdc652e98e3915302e2b7f597508e1b0cb0J5oiKWcEaSYToyOntzOjI6InRzIjtpOjE0Mjk0ODE0Mjk7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQyOTQ4MDg4OTg2MS5leGUiO30=  (microsoft_office_2013_x86_e_x64_pt_br_crack_serial_via_filmes_games_musicas_programas_downloader-q8u)

1 / 68      (Adware)
http://sub.goveba.info/NcqrINEg282705cde89b8ad2f6c58e6e7214e2d1e0izG4JUMUf3YToyOntzOjI6InRzIjtpOjE0MjkyNzY2NDk7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQyOTI3MjE0NjAyMC5leGUiO30=  (fastandfurious7frenchdvdrip2015_downloader-n3hmkiiiz.exe)

1 / 68      (Adware)
http://sub.goveba.info/N1j2BwwW01a923796ac4548319a9e0434f176589d00IcpGycNovYToyOntzOjI6InRzIjtpOjE0MjkyODMzMDE7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQyOTI4Mjg4Njc4OC5leGUiO30=  (coursecontrelamontrefrenchdvdrip2015_downloader-nddjscfyh.exe)

1 / 68      (Adware)
http://sub.goveba.info/N5YmUmaMz9b20e6f9c573983707225a13ad7f47500alqFnwQNv3YToyOntzOjI6InRzIjtpOjE0MjkyNzc1NDQ7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQyOTI3MjE0MTcxNS5leGUiO30=  (idm6_downloader-n0zwvaw6s.exe)

1 / 68      (PUP)
http://sub.goveba.info/N230EEIQia1229b4a00eb9b89704e1895de8281ce0W5aciqCXuMYToyOntzOjI6InRzIjtpOjE0Mjk0MTg3MzI7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQyOTMxODk5NDc5Ny5leGUiO30=  (filedownloaded20successfully_downloader-n230eeiqi.exe)

18 / 68    (Adware)
http://sub.goveba.info/Ncqdwretje1ac32a2f03fb4cf784c109d91fef34d0ErczNbN6OKYToyOntzOjI6InRzIjtpOjE0MjkyODMzOTQ7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQyOTI4Mjg3ODQwOC5leGUiO30=  (vgoxixi2.exe)

1 / 68      (PUP)
http://sub.goveba.info/NfEjIerss30d72ab3ebe54d45da899e196b9b837b0IRrQYo0EuAYToyOntzOjI6InRzIjtpOjE0Mjk0OTEwNDU7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQyOTQzNDA4Mzc0NC5leGUiO30=  (filedownloaded20successfully_downloader-nfejierss.exe)

1 / 68      (Adware)
http://sub.goveba.info/NbUJUtMeA0a9ef04a82aa310b241c5715b300fafa0YXz1eRaE17YToyOntzOjI6InRzIjtpOjE0MjkzMjc0MTg7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQyOTMyNjA3ODE1Ni5leGUiO30=  (pointblankonlineterbarufullclientinstaller22042014_downloader-nbujutmea.exe)

18 / 68    (Adware)
http://sub.goveba.info/Ner8zhjX6a31309ee7709937545f79971d371b1180Xqh4GcBDMnYToyOntzOjI6InRzIjtpOjE0MjkzNzA3NzQ7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQyOTM2NTczOTYzNS5leGUiO30=  (freezip_downloader-n3x2haprd.exe)

1 / 68      (Adware)
http://sub.goveba.info/Q4YzSbdZaad0789a3415cdd8aac125d7bf95b7e510iGWQmFrhE6YToyOntzOjI6InRzIjtpOjE0MjkzODA5MTc7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQyOTM4MDA4ODQ5NC5leGUiO30=  (office_2013_professional_plus_codigo_serial_valido_maismacetes_downloader-q4yzsbdza.exe)

1 / 68      (PUP)
http://sub.goveba.info/N0209BQQr163f264ed835012ca6458c8231d196a30KpXbUrTQloYToyOntzOjI6InRzIjtpOjE0Mjk1MDA2MDU7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQyOTM5MDk4NDkxNi5leGUiO30=  (flvplayer_downloader-n0209bqqr.exe)

1 / 68      (Adware)
http://sub.goveba.info/QeCzqm9qUead1dea89bda9d0625e2fa4e67bbeec60PrNDcHIJwSYToyOntzOjI6InRzIjtpOjE0Mjk0ODMzNTI7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQyOTQ4MDg4NTExNy5leGUiO30=  (flvtubeplayer_downloader-qeczqm9qu.exe)

1 / 68      (Adware)
http://sub.goveba.info/NdYIalIY6f06b371a20c0f8b953ce3fd0473edea108nHBW9DFQEYToyOntzOjI6InRzIjtpOjE0Mjk0NzYxNDg7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQyOTQ3MDA5MDc5Mi5leGUiO30=  (flvplayer_downloader-ndyialiy6.exe)

1 / 68      (Adware)
http://sub.goveba.info/N4N9bnGIA6ba8a9804cb3341223ea38d656a640290pqtPtzeXFbYToyOntzOjI6InRzIjtpOjE0MjkzODQ4MTY7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQyOTM4MDA3NjI5Ny5leGUiO30=  (flvplayer_downloader-n4n9bngia.exe)

 
Latest 30 of 51 download URLs

The following 96 files have been seen to comunicate with sub.goveba.info in live environments.

TCP » 54.192.55.178:80
britches.exe (Britches)

TCP » 54.192.55.192:80
uvconverter.exe (TODO: <Product name> by TODO: <Company name>)

TCP » 54.230.193.149:443
online-guardian-v2.0.9.exe

TCP » 54.192.55.178:80
smu.exe (W by Search Module)

TCP » 54.192.55.134:80
browserairexec.exe (BrowserAir by Goobzo)

TCP » 50.63.202.41:80
produpd.exe (produpd.exe by Vested Development, Inc)

TCP » 54.230.193.149:443
online-guardian-v2.0.9.exe

TCP » 54.192.55.178:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 54.192.55.192:80
browser.exe (Browser)

TCP » 50.63.202.41:80
produpd.exe (produpd.exe by Vested Development, Inc)

TCP » 54.192.55.178:80
yacqq.exe

TCP » 54.192.192.10:443
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 54.192.192.10:80
browser.exe (Browser)

TCP » 54.192.192.10:443
browser.exe (Browser)

TCP » 54.192.55.134:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 54.192.55.178:80
citrio.exe (Citrio by CatalinaGroup)

TCP » 54.192.55.192:80
uvconverter.exe (Copyright (C) 2016)

TCP » 50.63.202.41:80
online-guardian-v2.0.9.exe

TCP » 50.63.202.41:587
www.exe

TCP » 54.192.55.134:80
saber.exe

 
Latest 20 of 115 files

URL:
http://sub.goveba.info/

Title:
“404 - PAGE NOT FOUND”

Network:
Amazon Cloudfront

Web server:
nginx/1.8.1

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.