The domain sub.u2dbn.net registered by Joseph Davidson was initially registered in December of 2014 through GANDI SAS. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Dulles, Virginia within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Cloudfront CDN service which utilizes a number of proxy IP Addresses (see below).
Registrant:
Joseph Davidson
Server location:
Virginia, United States (US)
Create date:
Tuesday, December 9, 2014
Expires date:
Friday, December 9, 2016
Updated date:
Wednesday, November 4, 2015
ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US
Google Safe Browsing:
unwanted
Scanner detections:
Detections (98% detected)
Scan engine
Details
Detections
Reason Heuristics
PUP.Somoto.K, PUP.Installer.Somoto.F, PUP.Somoto.J, PUP.Bundler.Somoto, Threat.Somoto.Bundler, PUP.Somoto.Bundler, PUP.Somoto.Bundler (M), PUP.Somoto.Installer (M), PUP.Somoto (M)
100.00%
avast!
Somoto-R [PUP], Win32:Somoto-R [PUP]
44.19%
Kaspersky
not-a-virus:Downloader.Win32.Agent
44.19%
Sophos
PUA 'Somoto BetterInstaller'
44.19%
AhnLab V3 Security
Win-PUP/Somoto
44.19%
AVG
Generic, Potentially harmful program Downloader.DFF
44.19%
Baidu Antivirus
Adware.Win32.Somoto
44.19%
Dr.Web
Trojan.Packed.28357
41.86%
Panda Antivirus
PUP/MultiToolbar.A, Generic Malware
39.53%
Qihoo 360 Security
Win32/Virus.Downloader.192
37.21%
McAfee
Artemis!3622DD0CD384, Artemis!A4619AE50EBE, Artemis!CB5E49E44604, Artemis!1DFC4B39E80E, RDN/Generic PUP.x!crc, Artemis!202053AC0242
32.56%
Trend Micro House Call
TROJ_GEN.R0C1H07LQ14, TROJ_GEN.R0C1H07LS14, TROJ_GEN.R047H07LR14, Suspicious_GEN.F47V1225, TROJ_GEN.R08NH07LR14, TROJ_GEN.R047H07LP14
32.56%
ESET NOD32
Win32/Somoto
30.23%
VIPRE Antivirus
Threat.4150696, Trojan.Win32.Generic
23.26%
Malwarebytes
PUP.Optional.Somoto
18.60%
The domain sub.u2dbn.net has been seen to resolve to the following 136 IP addresses.
server-52-84-125-168.iad16.r.cloudfront.net
August 30, 2016
server-52-84-125-19.iad16.r.cloudfront.net
August 30, 2016
server-52-84-125-78.iad16.r.cloudfront.net
August 24, 2016
server-52-84-125-5.iad16.r.cloudfront.net
August 24, 2016
server-52-84-125-179.iad16.r.cloudfront.net
August 22, 2016
server-52-84-125-116.iad16.r.cloudfront.net
August 22, 2016
server-52-84-125-103.iad16.r.cloudfront.net
August 22, 2016
server-52-84-125-99.iad16.r.cloudfront.net
August 22, 2016
server-52-84-125-79.iad16.r.cloudfront.net
August 22, 2016
server-52-84-125-34.iad16.r.cloudfront.net
August 22, 2016
server-52-84-125-220.iad16.r.cloudfront.net
August 22, 2016
server-52-85-131-107.iad53.r.cloudfront.net
July 24, 2016
server-52-85-131-62.iad53.r.cloudfront.net
July 24, 2016
server-52-85-131-215.iad53.r.cloudfront.net
July 24, 2016
server-52-84-125-133.iad16.r.cloudfront.net
July 23, 2016
server-52-84-125-52.iad16.r.cloudfront.net
July 23, 2016
server-52-84-125-25.iad16.r.cloudfront.net
July 23, 2016
server-52-84-125-230.iad16.r.cloudfront.net
July 23, 2016
server-52-84-125-148.iad16.r.cloudfront.net
July 23, 2016
server-52-84-125-144.iad16.r.cloudfront.net
July 23, 2016
server-52-84-125-106.iad16.r.cloudfront.net
July 17, 2016
server-52-84-125-102.iad16.r.cloudfront.net
July 17, 2016
server-52-84-125-92.iad16.r.cloudfront.net
July 17, 2016
server-52-84-125-66.iad16.r.cloudfront.net
July 17, 2016
server-52-84-125-47.iad16.r.cloudfront.net
July 17, 2016
server-52-84-125-37.iad16.r.cloudfront.net
July 17, 2016
server-52-84-125-170.iad16.r.cloudfront.net
July 17, 2016
server-52-85-131-80.iad53.r.cloudfront.net
July 17, 2016
server-52-85-131-54.iad53.r.cloudfront.net
July 17, 2016
server-52-85-131-31.iad53.r.cloudfront.net
July 17, 2016
Showing 30 of 136 IP Addresses
File downloads found at URLs served by sub.u2dbn.net.
Latest 30 of 46 download URLs
The following 72 files have been seen to comunicate with sub.u2dbn.net in live environments.
URL:
http://sub.u2dbn.net/
Network:
Amazon Cloudfront