home

b.getdownload.net

Whois protection, this company does not own this domain name s.r.o.

Domain Information

The domain b.getdownload.net registered by Whois protection, this company does not own this domain name s.r.o. was initially registered in June of 2015 through HEBEI GUOJI MAOYI (SHANGHAI) LTD DBA HEBEIDOMAINS.COM. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Dallas, Texas within the United States.
Registrar:
HEBEI GUOJI MAOYI (SHANGHAI) LTD DBA HEBEIDOMAINS.COM

Server location:
Texas, United States (US)

Create date:
Monday, June 29, 2015

Expires date:
Wednesday, June 29, 2016

Updated date:
Wednesday, September 23, 2015

ASN:
AS46475 LIMESTONENETWORKS - Limestone Networks, Inc.,US

Root domain:
getdownload.net

Whois:
1 getdownload.net record

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
Threat.Win.Reputation.IMP, PUP.Catalina.CatalinaGroup (M), PUP.Catalina (M), PUP.SaveAs (L)
100.00%

McAfee
Artemis!1F559A3DE310, PUP-FEP
23.08%

Comodo Security
Application.Win32.Maxiget.~A, Application.Win32.NewIT.B, Application.Win32.Downloader.Agent.AM
23.08%

Dr.Web
Adware.Downware.1491, Trojan.StartPage.54627, Trojan.StartPage.54626
23.08%

VIPRE Antivirus
Trojan.Win32.Generic, Threat.4150696
23.08%

Sophos
4Share Downloader, PUA '4Share Downloader'
23.08%

G Data
Adware.Generic.591724, Win32.Trojan-Downloader.Agent.BA
23.08%

Vba32 AntiVirus
suspected of Trojan.Downloader.gen.h, Downloader.Agent
23.08%

Trend Micro House Call
TROJ_GEN.R0CBH09J213, TSPY_DOWNLOADER_CK200005.UVPA
15.38%

Avira AntiVirus
Adware/Maxiget.A, APPL/Downloader.Gen6
15.38%

ESET NOD32
Win32/4Shared.F potentially unwanted application
15.38%

Malwarebytes
PUP.Optional.4Shared
15.38%

Zillya! Antivirus
Downloader.Agent.Win32.182358, Trojan.Black.Win32.16861
15.38%

K7 AntiVirus
Backdoor , Unwanted-Program
15.38%

Agnitum Outpost
Trojan.Agent, Trojan.StartPage
15.38%

The domain b.getdownload.net has been seen to resolve to the following 8 IP addresses.

51.254.28.160
September 16, 2016

158.69.145.49
July 12, 2016

109.201.135.34
.
June 26, 2016

158.69.145.48
June 21, 2016

158.69.145.50
June 4, 2016

69.162.80.58
58-80-162-69.static.reverse.lstn.net
April 10, 2016

69.162.80.59
59-80-162-69.static.reverse.lstn.net
April 8, 2016

95.211.117.215
February 13, 2016

File downloads found at URLs served by b.getdownload.net.

2 / 68      (PUP)
http://b.getdownload.net/smart-download/11055/.../SaveAs.brazil.exe  (b5255b7cc0f949ba345952830b8d7424)

1 / 68      (PUP)
http://b.getdownload.net/smart-download/11062/.../SaveAs.id.exe  (ad3412c907a9480640363f8caedbcdf8)

1 / 68      (PUP)
http://b.getdownload.net/smart-download/11062/.../SaveAs.id.exe  (726a4e99ea5d973bfbf813267639956c)

1 / 68      (PUP)
http://b.getdownload.net/smart-download/11971/.../SaveAs.ua.exe  (49038d459fdaf65ccda3afa4f23b8240)

1 / 68      (Malware)
http://b.getdownload.net/smart-download/.../bundle=NDA1M3wyODExOHxJRHwyfDE  (saveas.id.exe)

1 / 68      (PUP)
http://b.getdownload.net/smart-download/11062/.../SaveAs.id.exe  (52844afc47573bf685fa5209af8ccba1)

1 / 68      (PUP)
http://b.getdownload.net/smart-download/11062/.../SaveAs.id.exe  (9c490f8063384b1838b38de52d19fb42)

1 / 68      (PUP)
http://b.getdownload.net/smart-download/11966/.../SaveAs.sa.exe  (4883cca45bd0152e64ddd3266f73c91f)

1 / 68      (PUP)
http://b.getdownload.net/smart-download/11055/.../SaveAs.brazil.exe  (39848794bdb21b3a3b9e8a38a28468cb)

1 / 68      (Malware)
http://b.getdownload.net/smart-download/11066/.../SaveAs.th.exe  (688479639da141dff5868a8c93ef8f28)

26 / 68    (PUP)
http://b.getdownload.net/smart-download/11055/.../SaveAs.brazil.exe  (88b758638478d52a30dab6e0692e5a52)

18 / 68    (PUP)
http://b.getdownload.net/smart-download/11066/.../SaveAs.th.exe  (3d1b7cf0036def5c413dd6ec66ed74c4)

15 / 68    (PUP)
http://b.getdownload.net/smart-download/51911733/.../PDF Viewer Plugin.exe  (1f559a3de310e65c8589f895c4e8466d)

The following 5 files have been seen to comunicate with b.getdownload.net in live environments.

TCP » 69.162.80.59:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 69.162.80.59:80
citrio.exe (Citrio by CatalinaGroup)

TCP » 69.162.80.59:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 158.69.145.50:80
torrenthandler.crx

TCP » 69.162.80.59:4090
directx11.exe

URL:
http://b.getdownload.net/

Title:
“Loading....”

Web server:
Apache-Coyote/1.1

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.