home

cdn.bubbledock.co.uk

Nosibay

Domain Information

This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Dulles, Virginia within the United States. The domain uses the Amazon Cloudfront CDN service which utilizes a number of proxy IP Addresses (see below).
Server location:
Virginia, United States (US)

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
bubbledock.co.uk

Whois:
1 bubbledock.co.uk record

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Installer.NOSIBAY.Y, PUP.Installer.NOSIBAY.DD, PUP.Installer.NOSIBAY.S, PUP.NOSIBAY, PUP.NOSIBAY.Installer (M)
100.00%

VIPRE Antivirus
BubbleDock, Trojan.Win32.Generic, Threat.4791953
82.35%

Vba32 AntiVirus
suspected of Trojan.Downloader.gen.h
64.71%

McAfee
Artemis!AF46B04A9F29, Artemis!361143759E70, Artemis!B100CAE8E6D4, Artemis!8D2654E8D396, Artemis!D1378CE921F6, Artemis!B80241F8D24A
52.94%

Malwarebytes
PUP.Optional.BubbleDock.A, PUP.Optional.Nosibay.A
52.94%

Trend Micro House Call
TROJ_GEN.F47V1218, TROJ_GEN.F47V0227, TROJ_GEN.F47V0317, BREX_BUBDOC.A, Suspicious_GEN.F47V0806, Suspicious_GEN.F47V0320
52.94%

AVG
Generic
47.06%

Dr.Web
Adware.Downware.5766, Adware.Downware.9155, Adware.Downware.10519, Adware.Downware.10519, Adware.Downware.9155
41.18%

ESET NOD32
Win32/BubbleDock, Win32/BubbleDock.A potentially unwanted
23.53%

K7 AntiVirus
Unwanted-Program , Riskware , Trojan
23.53%

Bkav FE
W32.HfsAdware
23.53%

Sophos
Generic PUA KK, Bubble Dock, PUA 'Bubble Dock' (of type Adware)
17.65%

ESET NOD32
Win32/BubbleDock.A potentially unwanted application
17.65%

herdProtect (fuzzy)
a variant of a8909ba7eb718fd1020c88658143952f53997c1f, a variant of e5f582616edd6afaebba63cf45489ac60cdf855b, a variant of a1cb2806d21307f77da1a5f13cde7fea1bc4e84f
17.65%

Rising Antivirus
PE:Malware.XPACK/RDM!5.1, NS:Malware.Install!1.9F21
11.76%

The domain cdn.bubbledock.co.uk has been seen to resolve to the following 83 IP addresses.

52.84.125.238
server-52-84-125-238.iad16.r.cloudfront.net
August 28, 2016

52.84.125.228
server-52-84-125-228.iad16.r.cloudfront.net
August 28, 2016

52.84.125.62
server-52-84-125-62.iad16.r.cloudfront.net
August 28, 2016

52.84.125.57
server-52-84-125-57.iad16.r.cloudfront.net
August 28, 2016

52.84.125.54
server-52-84-125-54.iad16.r.cloudfront.net
August 28, 2016

52.84.125.23
server-52-84-125-23.iad16.r.cloudfront.net
August 28, 2016

52.84.125.6
server-52-84-125-6.iad16.r.cloudfront.net
August 28, 2016

52.84.125.5
server-52-84-125-5.iad16.r.cloudfront.net
August 28, 2016

52.85.131.115
server-52-85-131-115.iad53.r.cloudfront.net
July 24, 2016

52.85.131.82
server-52-85-131-82.iad53.r.cloudfront.net
July 24, 2016

52.85.131.48
server-52-85-131-48.iad53.r.cloudfront.net
July 24, 2016

52.85.131.41
server-52-85-131-41.iad53.r.cloudfront.net
July 24, 2016

52.85.131.250
server-52-85-131-250.iad53.r.cloudfront.net
July 24, 2016

52.85.131.246
server-52-85-131-246.iad53.r.cloudfront.net
July 24, 2016

52.85.131.179
server-52-85-131-179.iad53.r.cloudfront.net
July 24, 2016

52.85.131.154
server-52-85-131-154.iad53.r.cloudfront.net
July 24, 2016

52.85.131.175
server-52-85-131-175.iad53.r.cloudfront.net
July 5, 2016

52.85.131.102
server-52-85-131-102.iad53.r.cloudfront.net
July 5, 2016

52.85.131.72
server-52-85-131-72.iad53.r.cloudfront.net
July 5, 2016

52.85.131.215
server-52-85-131-215.iad53.r.cloudfront.net
July 5, 2016

52.85.131.206
server-52-85-131-206.iad53.r.cloudfront.net
July 5, 2016

52.85.131.196
server-52-85-131-196.iad53.r.cloudfront.net
July 5, 2016

52.85.131.176
server-52-85-131-176.iad53.r.cloudfront.net
July 5, 2016

52.85.142.17
server-52-85-142-17.iad12.r.cloudfront.net
June 7, 2016

52.85.142.236
server-52-85-142-236.iad12.r.cloudfront.net
June 7, 2016

52.85.142.219
server-52-85-142-219.iad12.r.cloudfront.net
June 7, 2016

52.85.142.212
server-52-85-142-212.iad12.r.cloudfront.net
June 7, 2016

52.85.142.145
server-52-85-142-145.iad12.r.cloudfront.net
June 7, 2016

52.85.142.143
server-52-85-142-143.iad12.r.cloudfront.net
June 7, 2016

52.85.142.105
server-52-85-142-105.iad12.r.cloudfront.net
June 7, 2016

 
Showing 30 of 83 IP Addresses

File downloads found at URLs served by cdn.bubbledock.co.uk.

1 / 68      (PUP)
http://cdn.bubbledock.co.uk/setup/gb/.../65069.Bubble_Dock.BBD023.exe  (afa6d7f633b88a699d2cdfc1015417e4)

4 / 68      (PUP)
http://cdn.bubbledock.co.uk/cl/.../60190.Bubble_Dock.BBD023.no.exe  (c08c8285f5045261dfda6a0c25957d70)

1 / 68      (PUP)
http://cdn.bubbledock.co.uk/cl/.../59794.Bubble_Dock.BBD023.no.exe  (bubble dock bsetup.exe)

7 / 68      (PUP)
http://cdn.bubbledock.co.uk/cl/.../60224.Bubble_Dock.BBD023.no.exe  (361143759e70aef03a187125749258f2)

12 / 68    (PUP)
http://cdn.bubbledock.co.uk/bootstrap/gb/BOO001/.../Install_BubbleDock.exe  (nfnknmpone.exe)

7 / 68      (PUP)
http://cdn.bubbledock.co.uk/cl/.../59889.Bubble_Dock.BBD023.no.exe  (af46b04a9f290dd39c5c8a2bec073ecc)

3 / 68      (PUP)
http://cdn.bubbledock.co.uk/dld/update/2013_11_12/.../59755.Bubble Dock AddonsUI.exe  (adbf18154e4cdc5e909e2bdc92f33fa9)

10 / 68    (PUP)
http://cdn.bubbledock.co.uk/cl/.../60394.Bubble_Dock.BBD023.no.exe  (63f64f2b5ca22e72b219df3d36ffbfb5)

5 / 68      (PUP)
http://cdn.bubbledock.co.uk/dld/update/2015_01_26/.../AddonsUI.exe  (bubble dock addonsui.exe)

6 / 68      (PUP)
http://cdn.bubbledock.co.uk/dld/update/2015_03_12/.../AddonsUI.exe  (c6a47dee77cbfca1c77ae620f5e9d0fe)

5 / 68      (PUP)
http://cdn.bubbledock.co.uk/dld/update/2015_01_28/.../AddonsUI.exe  (bubble dock addonsui.exe)

14 / 68    (PUP)
http://cdn.bubbledock.co.uk/bootstrap/gb/BOO001/.../Install_BubbleDock.exe  (b72abc3239bff3efac2c14abf09513fa)

9 / 68      (PUP)
http://cdn.bubbledock.co.uk/dld/update/2015_03_20/.../AddonsUI.exe  (b80241f8d24acd250dd3d3d2d86e6dd1)

1 / 68      (PUP)
http://cdn.bubbledock.co.uk/bootstrap/gb/BOO001/.../Install_BubbleDock.exe  (f62ff147f2c0b75f67da3bef9c4b167c)

4 / 68      (PUP)
http://cdn.bubbledock.co.uk/dld/update/2014_02_11/.../60190.Bubble Dock AddonsUI.exe  (a54c6c4df655387aea50eff804f8a9ea)

14 / 68    (PUP)
http://cdn.bubbledock.co.uk/bootstrap/gb/BOO001/.../Install_BubbleDock.exe  (52249eefeef9cd12d87841ea14e1d52c)

7 / 68      (PUP)
http://cdn.bubbledock.co.uk/cl/.../60251.Bubble_Dock.BBD023.no.exe  (b100cae8e6d490ad3e278f3d1fe031a6)

16 / 68    (PUP)
http://cdn.bubbledock.co.uk/setup/gb/.../63100.Bubble_Dock.BBD023.no.exe  (6cfc89e105878e4d0a6e1532dcbb0b46)

The following 33 files have been seen to comunicate with cdn.bubbledock.co.uk in live environments.

TCP » 54.192.195.78:443
online-guardian-v2.0.9.exe

TCP » 54.192.195.242:443
online-guardian-v2.0.9.exe

TCP » 52.84.125.23:80
se.exe

TCP » 54.192.195.120:443
onlineguardian-v2.exe

TCP » 54.192.195.78:443
apptrailers.exe

TCP » 52.85.142.212:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.84.125.57:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.85.131.252:443
browser.exe (Browser)

TCP » 54.192.195.78:443
apptrailers.exe

TCP » 52.85.142.145:443
ManyCam.exe (ManyCam Virtual Webcam by Visicom Media)

TCP » 52.85.142.145:80
browser.exe (Browser)

TCP » 52.85.142.17:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.85.142.17:443
online-guardian-v2.0.9.exe

TCP » 52.85.142.17:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.85.142.56:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.85.142.105:80
apptrailers.exe

TCP » 52.84.125.5:80
browser.exe (Browser)

TCP » 52.85.142.212:443
browser.exe (Browser)

TCP » 52.85.142.212:443
online-guardian-v2.0.9.exe

TCP » 52.85.131.252:80
browser.exe (Browser)

 
Latest 20 of 91 files

URL:
http://cdn.bubbledock.co.uk/

Network:
Amazon Cloudfront

Web server:
AmazonS3

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.