» sub.whalba.info
Overview
Analysis
IPs Addresses (8)
Downloads (47)
Network (1)
Website Detail

sub.whalba.info

Domains By Proxy, LLC (Proxy Registrant)

Domain Information

The domain sub.whalba.info is registered by proxy through GoDaddy.com, LLC (R171-LRMS). This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Dulles, Virginia within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Cloudfront CDN service which utilizes a number of proxy IP Addresses (see below).

Registrant:

Domains By Proxy, LLC

Registrar:

GoDaddy.com, LLC (R171-LRMS)

Server location:

Virginia, United States (US)

ASN:

AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:

whalba.info

Whois:

1 whalba.info record

Scanner detections:

Detections (100% detected)

Scan engine

Details

Detections

Reason Heuristics

PUP.Bundler.Somoto, PUP.Somoto.Bundler, PUP.Somoto.SiteonSpot.Bundler (M), Adware.Somoto.Installer.Meta (M), PUP.Somoto.SiteonSp.Bundler (M), PUP.Somoto (M)

100.00%

Dr.Web

Adware.Somoto.131, Adware.Somoto.128

11.11%

VIPRE Antivirus

Threat.4150696, Trojan.Win32.Generic

11.11%

AVG

Potentially harmful program Downloader.DTV, AdLoad.R

11.11%

Kaspersky

not-a-virus:Downloader.Win32.Somato

11.11%

Clam AntiVirus

Win.Adware.Somoto

11.11%

Bkav FE

W32.HfsAdware

11.11%

Quick Heal

Adware.NSIS.BetterInstaller.A

11.11%

K7 AntiVirus

Trojan

11.11%

NANO AntiVirus

Riskware.Nsis.Adware.dpwuzb

11.11%

AhnLab V3 Security

PUP/Win32.Somoto

11.11%

Baidu Antivirus

Adware.Win32.Somoto

11.11%

ESET NOD32

Win32/Somoto.G potentially unwanted

11.11%

Panda Antivirus

Trj/Genetic.gen

11.11%

Trend Micro House Call

TROJ_GEN.R047H07DR15, TROJ_GEN.R047H07DQ15

4.44%

The domain sub.whalba.info has been seen to resolve to the following 8 IP addresses.

54.230.16.225

server-54-230-16-225.iad12.r.cloudfront.net

June 19, 2015

54.230.16.177

server-54-230-16-177.iad12.r.cloudfront.net

June 19, 2015

54.230.16.174

server-54-230-16-174.iad12.r.cloudfront.net

June 19, 2015

54.230.16.83

server-54-230-16-83.iad12.r.cloudfront.net

June 19, 2015

54.230.16.11

server-54-230-16-11.iad12.r.cloudfront.net

June 19, 2015

54.240.160.118

server-54-240-160-118.iad12.r.cloudfront.net

June 19, 2015

54.230.19.55

server-54-230-19-55.iad12.r.cloudfront.net

June 19, 2015

54.230.17.123

server-54-230-17-123.iad12.r.cloudfront.net

June 19, 2015

File downloads found at URLs served by sub.whalba.info.

1 / 68 (Adware)

http://sub.whalba.info/Q2NTr3wP9d2fad1716d6fa06f0582db8c59455f260Jcuj0MzmfvYToyOntzOjI6InRzIjtpOjE0MzAxOTE1NTM7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQzMDE5MDE5MDQzNC5leGUiO30= (flvtubeplayer_downloader-q2ntr3wp9.exe)

1 / 68 (PUP)

http://sub.whalba.info/Nba7GyR8Xa7abef925f2349d53e1cd7b04821d0e00fAVdsBoy9TYToyOntzOjI6InRzIjtpOjE0MzAwNDMzNjM7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQyOTk3NDIwMjczMS5leGUiO30= (filedownloaded20successfully_downloader-nbyg5mwwl.exe)

1 / 68 (PUP)

http://sub.whalba.info/N5mtiiKUh3bd7c9714b18b896baf45d61581bc8b10gx1wVLncsnYToyOntzOjI6InRzIjtpOjE0MzAwNzU3NDk7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQzMDAwMzA1MTE4Mi5leGUiO30= (filedownloaded20successfully_downloader-n5mtiikuh.exe)

1 / 68 (Adware)

http://sub.whalba.info/Q7q8fil0q26ec309b0043966001195e3de17e17ae0qlPeJ4EM2rYToyOntzOjI6InRzIjtpOjE0MzAxNDExNTI7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQzMDEzOTc5NTE3MC5leGUiO30= (marcelo-camelo-ao-vivo-no-theatro-são-pedro_downloader-q7q8fil0q.exe)

1 / 68 (Adware)

http://sub.whalba.info/NcNXivdYW032098027744cae694f7b667363527a00zc8i5Qe32QYToyOntzOjI6InRzIjtpOjE0MzAwNzk0OTc7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQzMDA3ODU0NDI5NS5leGUiO30= (easy_pvfrenchdvdrip2015_downloader-nebahtccb.exe)

1 / 68 (Adware)

http://sub.whalba.info/N5oQQBj8R68f587fd73f825743381d46c94ff199f0RAXjALFWmVYToyOntzOjI6InRzIjtpOjE0MzAxMTMxNDQ7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQzMDEwNzI4OTg1Ni5leGUiO30= (downloadfilmavengersageofultronsubtitleindonesia_downloader-n8mnqajbv.exe)

1 / 68 (Adware)

http://sub.whalba.info/QeLEHFXpf2136433ab40e6960a5f294ae4d4c2acc0ypDrCxqk4wYToyOntzOjI6InRzIjtpOjE0MzAxNDUzNDM7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQzMDE0MzM0MjM4NS5leGUiO30= (flvtubeplayer_downloader-qdytivxae.exe)

1 / 68 (Adware)

http://sub.whalba.info/Q6H7c7KDhea68a2968f45af899ce4b25df6ee3bd60dhm4MHZLRwYToyOntzOjI6InRzIjtpOjE0MzAxNTY3MzU7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQzMDE1NDE5OTIyMi5leGUiO30= (jorge-e-mateus-seu-olhar-_downloader-q6h7c7kdh.exe)

1 / 68 (Adware)

http://sub.whalba.info/Q2c0E4tmwe6d244964607ed5321183cf5ec9c91a80xVKnld82oOYToyOntzOjI6InRzIjtpOjE0MzAwNTYxOTE7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQzMDA1MzM0Mjc0NS5leGUiO30= (aquarium_004_downloader-q2c0e4tmw.exe)

1 / 68 (PUP)

http://sub.whalba.info/N67ibd0472a6e307a1eb8463989723a1d4104cf4b0U56CGsEgakYToyOntzOjI6InRzIjtpOjE0MzAwNTM3MTQ7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQyOTkxNjU4ODE5Ni5leGUiO30= (filedownloaded20successfully_downloader-n67ibd047.exe)

1 / 68 (PUP)

http://sub.whalba.info/N5iNs5iJ45fa471ee1a647cf5e435cec2ea3659710LTTuxnoT3rYToyOntzOjI6InRzIjtpOjE0MzAwNTM4MDk7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQyOTk1MjY0NjQ1OC5leGUiO30= (filedownloaded20successfully_downloader-n5ins5ij4.exe)

1 / 68 (Adware)

http://sub.whalba.info/Q6sjGYLefea308c1eeeefd27c9a0a4feb7c25097302riGpoQCUvYToyOntzOjI6InRzIjtpOjE0MzAxNDUzNDM7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQzMDE0MzM0NjY0NS5leGUiO30= (windows_7_todas_as_versoes_em_portugues_br_32_64_bits_completo_full_ph_downs_downloader-q6sjgylef.ex)

1 / 68 (Adware)

http://sub.whalba.info/QeKbkPbiQ9f14195ce18f9c52339d212c862da41f0WiE7ZVmXOHYToyOntzOjI6InRzIjtpOjE0MzAyMzQ2NDE7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQzMDIzMzMzNTE5NC5leGUiO30= (flvtubeplayer_downloader-qekbkpbiq.exe)

1 / 68 (Adware)

http://sub.whalba.info/Q6LZcgShza13cad970109f8cf3c61670cc1c7dd7603czwsQQa2YYToyOntzOjI6InRzIjtpOjE0MzAxOTAyODY7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQzMDE5MDE5OTc0My5leGUiO30= (autocad_2014_serial_valido_atualizado_maismacetes_downloader-q6lzcgshz.exe)

1 / 68 (Adware)

http://sub.whalba.info/Q7SrNqGSSf964ab5ee48b87d4976c10e02b560fb30B3fMXHZpl8YToyOntzOjI6InRzIjtpOjE0MzAyNDczMzc7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQzMDI0NDE5Nzg0NS5leGUiO30= (idm6_downloader-n0jp9djdo.exe)

1 / 68 (PUP)

http://sub.whalba.info/N4svISg9A03f1fd0a25c9506bce0836ac938f2ca30CXDUXpf7s8YToyOntzOjI6InRzIjtpOjE0MzAwNjYzMjQ7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQzMDAyODE3ODg5Ni5leGUiO30= (filedownloaded20successfully_downloader-n4svisg9a.exe)

1 / 68 (PUP)

http://sub.whalba.info/N4M6ZLcdh576c6fc6357fce2c8fae6616e1e374700FyZUxOSSMEYToyOntzOjI6InRzIjtpOjE0MzAyNDkwNTk7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQzMDIwMDk3NTg1NS5leGUiO30= (filedownloaded20successfully_downloader-n4m6zlcdh.exe)

14 / 68 (Adware)

http://sub.whalba.info/Q8beYs5iRe3ca0b76c63b2b0873c6ee172bbbdb110xi8z6Huq1FYToyOntzOjI6InRzIjtpOjE0MzAxNjI0NTk7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQzMDE1NzY4ODg5MS5leGUiO30= (tootsiefrfrenchdvdrip2015_downloader-n1usvfe2f.exe)

15 / 68 (Adware)

http://sub.whalba.info/N5tBY1xCk944788c5158c32b8d26b44df65d1fe690MHX8Fb4maJYToyOntzOjI6InRzIjtpOjE0MzAxNTk2MDg7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQzMDE1NzY4Mzc3My5leGUiO30= (flvtubeplayer_downloader-q3wfk20xt.exe)

1 / 68 (PUP)

http://sub.whalba.info/N9SeyC4fJdb4e8bb41ea9cac78acf57cb3876861e0H0b1146TV0YToyOntzOjI6InRzIjtpOjE0MzAyMTk2Njc7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQzMDA5Mjk0NTk4MC5leGUiO30= (filedownloaded20successfully_downloader-n9seyc4fj.exe)

1 / 68 (Adware)

http://sub.whalba.info/Q0bb1bgUt7adee80597d09c6d56f3657925bc3cf60Nc9g38UnDBYToyOntzOjI6InRzIjtpOjE0MzAwODI3NDk7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQzMDA4MjE0MjY2Mi5leGUiO30= (dvdshrink32setup_downloader-q0bb1bgut.exe)

1 / 68 (PUP)

http://sub.whalba.info/N1oS0NYWVa046013f24534a8aec56d33ca5a5458901eBE5hQGDfYToyOntzOjI6InRzIjtpOjE0MzAwNjE4MzI7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQyOTg5ODU4NzI2MC5leGUiO30= (filedownloaded20successfully_downloader-n9ap1tczi.exe)

1 / 68 (Adware)

http://sub.whalba.info/NeoiFkOsL4fce403b176622a8079b0577c19148050RNyEbIj6neYToyOntzOjI6InRzIjtpOjE0MzAxNDk1OTQ7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQzMDE0MzMzNzQ4My5leGUiO30= (youwaveforandroid4_downloader-neoifkosl.exe)

1 / 68 (PUP)

http://sub.whalba.info/N8FY6VRyY8f5e7e8c86487b81fd3143897dd1c8500Ot0ztvqeyRYToyOntzOjI6InRzIjtpOjE0MzAxMDUwODk7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQzMDAyNDU0MzUxNi5leGUiO30= (onlineweather_downloader-n8fy6vryy.exe)

1 / 68 (PUP)

http://sub.whalba.info/N6H9deSz872bd4a1491bca887528592f388e391d705jKrODIp8KYToyOntzOjI6InRzIjtpOjE0MzAwOTg3NDM7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQzMDAxMzc4MTcwNy5leGUiO30= (filedownloaded20successfully_downloader-n6h9desz8.exe)

14 / 68 (Adware)

http://sub.whalba.info/Q6TRpxquR4c5fa35da3546cf79e3ab5cfd7d6d5e90GMERw1NT7CYToyOntzOjI6InRzIjtpOjE0MzAxMzkxMTI7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQzMDEzNjE0MzE2Ni5leGUiO30= (martialarts_capoeirafullrip_downloader-n9epvfrz2.exe)

1 / 68 (PUP)

http://sub.whalba.info/N6NyhAazB383b90533ee6689a982e26a5963a1090083Qjd5JQLfYToyOntzOjI6InRzIjtpOjE0MzAwMjQxMzg7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQyOTkyNzM0MDIwOS5leGUiO30= (filedownloaded20successfully_downloader-n6nyhaazb.exe)

1 / 68 (PUP)

http://sub.whalba.info/N6NyhAazB63afedc2b92c4633dfdbe52d4357480d0RU4XI2F8ZEYToyOntzOjI6InRzIjtpOjE0MzAwMjQxMDI7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQyOTkyMDEzMjc3My5leGUiO30= (filedownloaded20successfully_downloader-n6nyhaazb.exe)

1 / 68 (PUP)

http://sub.whalba.info/N9aP1Tczi7af7af27c7c7c89f00c9f3ab3fee17f10W1zMWQPRK7YToyOntzOjI6InRzIjtpOjE0MzAwMjQxNzA7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQyOTg5ODU4NzI2MC5leGUiO30= (filedownloaded20successfully_downloader-n9ap1tczi.exe)

1 / 68 (Adware)

http://sub.whalba.info/N7b4JgmXjcc780e63cf10dfa06089ff4e99a313760qgI1y7bGM5YToyOntzOjI6InRzIjtpOjE0MzAwNDEyMzA7czoxOiJmIjtzOjcyOiIvaG9tZS93d3cvYXNzZXRzL2JldHRlcl9pbnN0YWxsZXIvaW5zdGFsbGVycy9jbGkvc2V0dXBfMTQzMDAzODg4MzQ1My5leGUiO30= (youwaveforandroid4_downloader-n7b4jgmxj.exe)

Latest 30 of 47 download URLs

The following file have been seen to comunicate with sub.whalba.info in live environments.

TCP » 54.230.16.177:443

u.exe

URL:

http://sub.whalba.info/

Network:

Amazon Cloudfront

Web server:

nginx

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.