v4download.com

Whois Privacy Corp.

Domain Information

The domain v4download.com registered by Whois Privacy Corp. was initially registered in December of 2013 through INTERNET.BS CORP.. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Phoenix, Arizona within the United States which resides on the CloudFlare, Inc. network. The domain uses the CloudFlare CDN, a distributed domain name server service which utilizes a number of reverse proxy IP Addresses (see below).
Registrar:
INTERNET DOMAIN SERVICE BS CORP

Server location:
Arizona, United States (US)

Create date:
Friday, December 20, 2013

Expires date:
Tuesday, December 20, 2016

Updated date:
Thursday, December 24, 2015

ASN:
AS13335 CLOUDFLARENET - CloudFlare, Inc.,US

Scanner detections:
Detections  (95% detected)

Scan engine
Details
Detections

AhnLab V3 Security
PUP/Win32.Amonetize, Trojan/Win32.Gen
88.37%

ESET NOD32
Win32/Amonetize.BN (variant), Win32/Amonetize.BP (variant), Win32/Amonetize.BY (variant), Win32/Amonetize.CH (variant), Win32/Amonetize.BK (variant)
81.40%

Avira AntiVirus
Adware/Amonetize.tzw, Adware/Amonetize.505936, ADWARE/Adware.Gen2, ADWARE/Adware.Gen4, Adware/Amonetize.575168.1, Adware/Amonetize.575168.26
79.07%

Reason Heuristics
Threat.Win.Reputation.IMP, PUP.Installer.ITLGROUP.I, PUP.Installer.ITLGROUP.p, PUP.Installer.SVANTRANS.f, PUP.Installer.ITLGROUP.U, Adware.Amonetize.Installer.Installer.Meta (M)
74.42%

G Data
Gen:Variant.Graftor.154346, Trojan.GenericKD.1961750, Gen:Variant.Adware.Strictor.68509, Gen:Variant.Application.Jaik.4831
72.09%

Bitdefender
Gen:Variant.Graftor.154346, Trojan.GenericKD.1961750, Gen:Variant.Adware.Strictor.68509, Gen:Variant.Application.Jaik.4831
67.44%

MicroWorld eScan
Gen:Variant.Graftor.154346, Gen:Variant.Adware.Strictor.68509, Gen:Variant.Application.Jaik.4831, Win32.Virtob.Gen.12, Gen:Variant.Adware.Netfilter.2, Gen:Variant.Application.Bundler.Amonetize.11, Application.Bundler.Amonetize.AO, Gen:Variant.Application.Bundler.AirInstaller.1, Gen:Variant.Adware.Strictor.77177
65.12%

F-Secure
Gen:Variant.Graftor.154346, Trojan.GenericKD.1961750, Gen:Variant.Adware.Strictor.68509, Gen:Variant.Application.Jaik, Win32.Virtob.Gen.12
62.79%

Lavasoft Ad-Aware
Gen:Variant.Graftor.154346, Trojan.GenericKD.1961750, Gen:Variant.Adware.Strictor.68509, Gen:Variant.Application.Jaik.4831
60.47%

McAfee Web Gateway
BehavesLike.Win32.Backdoor.dc, BehavesLike.Win32.BadFile.gc, BehavesLike.Win32.BadFile.gh, BehavesLike.Win32.Downloader.gc, Artemis
60.47%

Qihoo 360 Security
HEUR/Malware.QVM18.Gen, HEUR/QVM10.1.Malware.Gen, Win32/Application.756, HEUR/QVM18.1.Malware.Gen, HEUR/QVM16.0.Malware.Gen
60.47%

McAfee
RDN/Generic PUP.x!cmm, Artemis!A899877F6401, Artemis!07F4C9BE54FD, Artemis!77A8C30E4081, Artemis!C5074D107539, Artemis!A66A5A0B0278, Artemis!25FA8E20472F
58.14%

Trend Micro House Call
Suspicious_GEN.F47V0909, Suspicious_GEN.F47V1120, Suspicious_GEN.F47V1115, Suspicious_GEN.F47V1205, Suspicious_GEN.F47V1209, Suspicious_GEN.F47V1213, Suspicious_GEN.F47V1226, Suspicious_GEN.F47V1231
53.49%

Sophos
Generic PUA AK, Generic PUA FM, Generic PUA KP, Generic PUA BG, Generic PUA MP, Generic PUA GN, Generic PUA NK, Generic PUA EO
53.49%

Fortinet FortiGate
Riskware/Amonetize, W32/Virut.CE, Adware/Amonetize, Adware/Generic
51.16%

The domain v4download.com has been seen to resolve to the following 14 IP addresses.

November 10, 2014

November 10, 2014

October 20, 2014

October 20, 2014

July 31, 2014

July 31, 2014

(CloudFlare)
July 3, 2014

(CloudFlare)
July 3, 2014

June 13, 2014

June 13, 2014

(CloudFlare)
May 1, 2014

(CloudFlare)
May 1, 2014

(CloudFlare)
February 27, 2014

(CloudFlare)
February 27, 2014

File downloads found at URLs served by v4download.com.

18 / 68    (PUP)

31 / 68    (PUP)

3 / 68      (inconclusive)

16 / 68    (Adware)

18 / 68    (PUP)

6 / 68      (Adware)

2 / 68      (false positives)

23 / 68    (Adware)
http://v4download.com/download.php?id=cting&title=LineLetsGetRichHackTool  (autobloggingsoftwarefullversion__7934_il1432405.exe)

28 / 68    (PUP)

6 / 68      (PUP)

19 / 68    (Adware)
http://v4download.com/download.php?id=ahmetmy&title=Spyhunter4.xCrack  (alabeo.cutlass.rg.ii__9138_i1414014146_il920494.exe)

24 / 68    (Adware)

11 / 68    (Adware)

29 / 68    (Adware)

12 / 68    (Adware)
http://v4download.com/download.php?id=Hunu87&title=directxautoupdatev2  (microsoftnetframework563__7934_il1452168.exe)

24 / 68    (Adware)

23 / 68    (Adware)

22 / 68    (PUP)

13 / 68    (PUP)

22 / 68    (Adware)
http://v4download.com/download.php?id=cting&title=KritikaChaosUnleashedHack  (revo uninstaller pro __10940_i1424283952_il65163.exe)

14 / 68    (Adware)

8 / 68      (Adware)

6 / 68      (Adware)

14 / 68    (Adware)

 
Latest 30 of 120 download URLs

February 27, 2014

URL:
http://v4download.com/

SSL certificate subject:
CN=sni55611.cloudflaressl.com, OU=PositiveSSL Multi-Domain, OU=Domain Control Validated

SSL certificate issuer:
CN=COMODO ECC Domain Validation Secure Server CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Web server:
cloudflare-nginx