The domain ttb.lpmxp2140.com registered by Domain Registries Foundation was initially registered in February of 2016 through SOLUCIONES CORPORATIVAS IP,SLU. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter.
Registrant:
Domain Registries Foundation
Registrar:
GODADDY.COM, LLC
Server location:
Oregon, United States (US)
Create date:
Friday, February 19, 2016
Expires date:
Sunday, February 19, 2017
Updated date:
Friday, February 19, 2016
ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US
Scanner detections:
Detections (95% detected)
Scan engine
Details
Detections
Reason Heuristics
PUP.Installer.DigitalPluginSl.F, PUP.Installer.DigitalPluginSl.M, PUP.DigitalPluginSl.G, PUP.Systweak.ThePhone.Installer.Meta (L), Win16.Generic, PUP.Softpulse.DigitalPluginSl.Bundler (M), PUP.Softpulse.PluginUpdate.Bundler (M), PUP.Softpulse.DIGITALPLUGINU.Installer (M), PUP.Softpulse.DigitalP.Bundler (M), Win32.Generic, PUP.Adknowledge.InstallM.Installer (M)
94.59%
Dr.Web
Trojan.DownLoader11.29457, Trojan.DownLoader11.30734, Threat.Undefined
21.62%
Kaspersky
not-a-virus:AdWare.Win32.Agent, not-a-virus:Downloader.Win32.Agent, Trojan.Win32.Buzus, Trojan-Downloader.Win32.Genome
21.62%
avast!
Win32:Malware-gen, Win32:GenMalicious-RJ [PUP], Win32:PUP-gen [PUP], Win32:SoftPulse-AH [PUP], Win32:SoftPulse-AE [PUP]
18.92%
AVG
Generic, Found Win32/DH{gRJ UIEHeVRPFVGBFYEJHFOBE0GBDw}, Adware Generic_c.DYZ, Adware AdPlugin.DQN
18.92%
VIPRE Antivirus
Threat.4150696, Threat.4783235
16.22%
Emsisoft Anti-Malware
Gen:Variant.Application.Strictor.62662, Application.Bundler.DomaIQ.T, Gen:Variant.Zusy.105611, Dropped:Trojan.GenericKD.2873614
16.22%
MicroWorld eScan
Gen:Variant.Application.Strictor.62662, Application.Bundler.DomaIQ.T, Gen:Variant.Zusy.105611, Gen:Variant.Symmi.46906, Dropped:Trojan.GenericKD.2873614
16.22%
McAfee
SoftPulse, Trojan.Artemis!E61FDADBFC87
16.22%
Malwarebytes
PUP.Optional.DomaIQ, PUP.Optional.DustApps
16.22%
K7 AntiVirus
Unwanted-Program , Trojan-Downloader
16.22%
Bitdefender
Gen:Variant.Application.Strictor.62662, Application.Bundler.DomaIQ.T, Gen:Variant.Zusy.105611, Gen:Variant.Symmi.46906, Dropped:Trojan.GenericKD.2873614
16.22%
NANO AntiVirus
Trojan.Win32.Buzus.dejvde, Riskware.Win32.SoftPulse.deniau, Riskware.Nsis.Downware.dymmbn
16.22%
G Data
Gen:Variant.Application.Strictor.62662, Application.Bundler.DomaIQ, Win32.Application.Softpulse, Gen:Variant.Symmi.46906
16.22%
ESET NOD32
Win32/SoftPulse.H potentially unwanted application, NSIS/TrojanDownloader.Agent.NTZ trojan
13.51%
The domain ttb.lpmxp2140.com has been seen to resolve to the following 7 IP addresses.
ec2-50-112-187-56.us-west-2.compute.amazonaws.com
October 9, 2014
ec2-50-112-131-232.us-west-2.compute.amazonaws.com
September 7, 2014
ec2-54-187-228-136.us-west-2.compute.amazonaws.com
September 2, 2014
File downloads found at URLs served by ttb.lpmxp2140.com.
Latest 30 of 39 download URLs
URL:
http://ttb.lpmxp2140.com/
Network:
Amazon Web Services (AWS), running an EC2 instance