home

sub.yourlipsfeelwarmtothetouch.com

Joseph Davidson

Domain Information

The domain sub.yourlipsfeelwarmtothetouch.com registered by Joseph Davidson was initially registered in May of 2015 through GANDI SAS. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Dulles, Virginia within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Cloudfront CDN service which utilizes a number of proxy IP Addresses (see below).
Registrar:
GANDI SAS

Server location:
Virginia, United States (US)

Create date:
Monday, May 11, 2015

Expires date:
Thursday, May 11, 2017

Updated date:
Wednesday, April 6, 2016

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
yourlipsfeelwarmtothetouch.com

Whois:
2 yourlipsfeelwarmtothetouch.com records

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Somoto.Bundler, PUP.Installer.SITEONSPOT, PUP.Somoto.SiteonSpot.Bundler (M), PUP.SITEONSPOT.Installer (M), PUP.Somoto.SiteonSp.Bundler (M), PUP.Somoto.SITEONSP.Bundler (M)
100.00%

Dr.Web
Adware.Somoto.131, Trojan.Packed.28357
52.00%

VIPRE Antivirus
Threat.4150696, Trojan.Win32.Generic
52.00%

AVG
Potentially harmful program Downloader.DFF, AdLoad.S
52.00%

Kaspersky
not-a-virus:Downloader.Win32.Somato, not-a-virus:Downloader.NSIS.Mazel
52.00%

Bkav FE
W32.HfsAdware
52.00%

MicroWorld eScan
Application.Bundler.Somoto.AG
52.00%

K7 AntiVirus
Unwanted-Program , Trojan , Adware
52.00%

Clam AntiVirus
Win.Adware.Somoto-2
52.00%

Bitdefender
Application.Bundler.Somoto.AG
52.00%

NANO AntiVirus
Trojan.Nsis.Downloader.dpxxrf, Riskware.Nsis.Adware.dshbbp
52.00%

Panda Antivirus
Trj/CI.A, PUP/Somoto
52.00%

Baidu Antivirus
Adware.Win32.Somoto
50.00%

Qihoo 360 Security
Win32/Virus.Downloader.912, Win32/Virus.099
50.00%

F-Secure
Application.Bundler.Somoto
50.00%

The domain sub.yourlipsfeelwarmtothetouch.com has been seen to resolve to the following 136 IP addresses.

54.230.193.249
server-54-230-193-249.iad53.r.cloudfront.net
August 28, 2016

54.230.193.206
server-54-230-193-206.iad53.r.cloudfront.net
August 28, 2016

54.230.193.192
server-54-230-193-192.iad53.r.cloudfront.net
August 28, 2016

54.230.193.155
server-54-230-193-155.iad53.r.cloudfront.net
August 28, 2016

54.230.193.119
server-54-230-193-119.iad53.r.cloudfront.net
August 28, 2016

54.230.193.91
server-54-230-193-91.iad53.r.cloudfront.net
August 28, 2016

54.230.193.79
server-54-230-193-79.iad53.r.cloudfront.net
August 28, 2016

54.230.193.36
server-54-230-193-36.iad53.r.cloudfront.net
August 28, 2016

52.84.125.128
server-52-84-125-128.iad16.r.cloudfront.net
August 27, 2016

52.84.125.239
server-52-84-125-239.iad16.r.cloudfront.net
August 27, 2016

52.84.125.238
server-52-84-125-238.iad16.r.cloudfront.net
August 27, 2016

52.84.125.222
server-52-84-125-222.iad16.r.cloudfront.net
August 27, 2016

52.84.125.206
server-52-84-125-206.iad16.r.cloudfront.net
August 27, 2016

52.84.125.170
server-52-84-125-170.iad16.r.cloudfront.net
August 27, 2016

52.84.125.166
server-52-84-125-166.iad16.r.cloudfront.net
August 27, 2016

54.192.19.57
server-54-192-19-57.iad12.r.cloudfront.net
August 25, 2016

54.192.19.51
server-54-192-19-51.iad12.r.cloudfront.net
August 25, 2016

54.192.19.41
server-54-192-19-41.iad12.r.cloudfront.net
August 25, 2016

54.192.19.29
server-54-192-19-29.iad12.r.cloudfront.net
August 25, 2016

54.192.19.237
server-54-192-19-237.iad12.r.cloudfront.net
August 25, 2016

54.192.19.230
server-54-192-19-230.iad12.r.cloudfront.net
August 25, 2016

54.192.19.86
server-54-192-19-86.iad12.r.cloudfront.net
August 25, 2016

54.192.19.79
server-54-192-19-79.iad12.r.cloudfront.net
August 25, 2016

52.84.125.184
server-52-84-125-184.iad16.r.cloudfront.net
July 5, 2016

52.84.125.150
server-52-84-125-150.iad16.r.cloudfront.net
July 5, 2016

52.84.125.119
server-52-84-125-119.iad16.r.cloudfront.net
July 5, 2016

52.84.125.109
server-52-84-125-109.iad16.r.cloudfront.net
July 5, 2016

52.84.125.91
server-52-84-125-91.iad16.r.cloudfront.net
July 5, 2016

52.84.125.75
server-52-84-125-75.iad16.r.cloudfront.net
July 5, 2016

52.84.125.74
server-52-84-125-74.iad16.r.cloudfront.net
July 5, 2016

 
Showing 30 of 136 IP Addresses

File downloads found at URLs served by sub.yourlipsfeelwarmtothetouch.com.

1 / 68      (Adware)
http://sub.yourlipsfeelwarmtothetouch.com/installers/bi_downloader/.../setup.exe  (nsdb6a6.tmp)

1 / 68      (Adware)
http://sub.yourlipsfeelwarmtothetouch.com/installers/bi_downloader/.../setup.exe  (nswd4b0.tmp)

1 / 68      (Adware)
http://sub.yourlipsfeelwarmtothetouch.com/installers/bi_downloader/.../setup.exe  (nsbcc7c.tmp)

22 / 68    (Adware)
http://sub.yourlipsfeelwarmtothetouch.com/installers/bi_downloader/.../setup.exe  (bi.exe)

1 / 68      (Adware)
http://sub.yourlipsfeelwarmtothetouch.com/installers/bi_downloader/.../setup.exe  (nsdb311.tmp)

1 / 68      (Adware)
http://sub.yourlipsfeelwarmtothetouch.com/installers/bi_downloader/.../setup.exe  (f7bd4179fc72e721f9fe8cca324821a1)

1 / 68      (Adware)
http://sub.yourlipsfeelwarmtothetouch.com/installers/bi_downloader/.../setup.exe  (nsv5538.tmp)

23 / 68    (Adware)
http://sub.yourlipsfeelwarmtothetouch.com/installers/bi_downloader/.../setup.exe  (nsc13b7.tmp)

21 / 68    (Adware)
http://sub.yourlipsfeelwarmtothetouch.com/installers/bi_downloader/.../setup.exe  (nsceb0e.tmp)

20 / 68    (Adware)
http://sub.yourlipsfeelwarmtothetouch.com/installers/bi_downloader/.../setup.exe  (nsh51f0.tmp)

20 / 68    (Adware)
http://sub.yourlipsfeelwarmtothetouch.com/installers/bi_downloader/.../setup.exe  (nsec9cd.tmp)

20 / 68    (Adware)
http://sub.yourlipsfeelwarmtothetouch.com/installers/bi_downloader/.../setup.exe  (nscd9a.tmp)

21 / 68    (Adware)
http://sub.yourlipsfeelwarmtothetouch.com/installers/bi_downloader/.../setup.exe  (nsc17c8.tmp)

1 / 68      (Adware)
http://sub.yourlipsfeelwarmtothetouch.com/installers/bi_downloader/.../setup.exe  (nst782f.tmp)

1 / 68      (Adware)
http://sub.yourlipsfeelwarmtothetouch.com/installers/bi_downloader/.../setup.exe  (bi.exe)

1 / 68      (Adware)
http://sub.yourlipsfeelwarmtothetouch.com/installers/bi_downloader/.../setup.exe  (nsmcd4.tmp)

1 / 68      (Adware)
http://sub.yourlipsfeelwarmtothetouch.com/installers/bi_downloader/.../setup.exe  (c312417b340505604fac9b93f242050d)

20 / 68    (Adware)
http://sub.yourlipsfeelwarmtothetouch.com/installers/bi_downloader/.../setup.exe  (nsh364f.tmp)

20 / 68    (Adware)
http://sub.yourlipsfeelwarmtothetouch.com/installers/bi_downloader/.../setup.exe  (nsl25fa.tmp)

1 / 68      (Adware)
http://sub.yourlipsfeelwarmtothetouch.com/installers/bi_downloader/.../setup.exe  (nsef4b1.tmp)

1 / 68      (Adware)
http://sub.yourlipsfeelwarmtothetouch.com/installers/bi_downloader/.../setup.exe  (nsge8bc.tmp)

1 / 68      (Adware)
http://sub.yourlipsfeelwarmtothetouch.com/installers/bi_downloader/.../setup.exe  (nsi12.tmp)

1 / 68      (Adware)
http://sub.yourlipsfeelwarmtothetouch.com/installers/bi_downloader/.../setup.exe  (bi.exe)

19 / 68    (Adware)
http://sub.yourlipsfeelwarmtothetouch.com/installers/bi_downloader/.../setup.exe  (nshd444.tmp)

1 / 68      (Adware)
http://sub.yourlipsfeelwarmtothetouch.com/installers/bi_downloader/.../setup.exe  (nsj1bab.tmp)

1 / 68      (Adware)
http://sub.yourlipsfeelwarmtothetouch.com/installers/bi_downloader/.../setup.exe  (nsdb89e.tmp)

19 / 68    (Adware)
http://sub.yourlipsfeelwarmtothetouch.com/installers/bi_downloader/.../setup.exe  (nswa078.tmp)

21 / 68    (Adware)
http://sub.yourlipsfeelwarmtothetouch.com/installers/bi_downloader/.../setup.exe  (nso5cca.tmp)

1 / 68      (Adware)
http://sub.yourlipsfeelwarmtothetouch.com/installers/bi_downloader/.../setup.exe  (nsje869.tmp)

21 / 68    (Adware)
http://sub.yourlipsfeelwarmtothetouch.com/installers/bi_downloader/.../setup.exe  (nsf365a.tmp)

 
Latest 30 of 63 download URLs

The following 181 files have been seen to comunicate with sub.yourlipsfeelwarmtothetouch.com in live environments.

TCP » 52.85.142.32:443
browserairexec.exe (BrowserAir by Goobzo)

TCP » 54.192.19.57:443
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 54.192.19.29:443
new_chrome.exe (1stBrowser by The 1stBrowser Authors)

TCP » 52.84.125.75:80
browser.exe (speed browser by Smart Applications)

TCP » 52.85.142.7:443
whatsapptime.exe

TCP » 54.192.19.230:80
ContentFinder.exe (ContentFinder by ContentFinder Software)

TCP » 54.192.19.237:80
saber.exe

TCP » 54.192.19.79:80
browser.exe (Browser)

TCP » 54.192.19.230:80
browserairexec.exe (BrowserAir by Goobzo)

TCP » 54.192.19.29:80
smu.exe (W by Search Module)

TCP » 54.192.19.86:443
clearscreenplayerbrowser.exe

TCP » 52.85.142.144:443
jingling.exe

TCP » 52.84.125.239:80
citrio.exe (Citrio by CatalinaGroup)

TCP » 54.192.19.230:443
online-guardian-v2.0.9.exe

TCP » 54.192.19.57:443
online-guardian-v2.0.9.exe

TCP » 52.85.142.154:80
GPlayer.exe (by Exent Technologies)

TCP » 54.192.19.57:80
ed2k.exe (aMule by http://www.amule.org/)

TCP » 52.85.131.252:443
browser.exe (Browser)

TCP » 52.85.142.220:443
browserairexec.exe (BrowserAir by Goobzo)

TCP » 54.192.19.51:80
stormwatchbrowser.exe

 
Latest 20 of 373 files

URL:
http://sub.yourlipsfeelwarmtothetouch.com/

Network:
Amazon Cloudfront

Web server:
nginx

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.