cdn.downloadbfiles.net

Privacy Protection Service INC d/b/a PrivacyProtect.org  (Proxy Registrant)

Domain Information

The domain cdn.downloadbfiles.net is registered by proxy through PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM and was originally registered in October of 2014. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Dublin, Dublin City within Ireland which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the EU (Ireland) region datacenter.
Registrar:
PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM

Server location:
Dublin City, Ireland (IE)

Create date:
Thursday, October 23, 2014

Expires date:
Sunday, October 23, 2016

Updated date:
Thursday, September 24, 2015

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:

Scanner detections:
Detections  (96% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.installCore.DownloadBlast.Installer (M), PUP.installCore.DownloadSphere.Installer (M), PUP.installCore.DownloadGuru.Installer (M), PUP.installCore.Installer (M), PUP.installCore.DownloadExpert.Installer (M), PUP.installCore.DownloadRocket.Installer (M), PUP.installCore.SoftwareProvider.Installer (M), PUP.installCore.SpeedyDownloads.Installer (M), PUP.installCore.Download.Installer (M), PUP.installCore.Download (M), PUP.InstallCore.TrustedD.Installer (M), PUP.installCore (M), PUP.InstallCore (M)
93.33%

Dr.Web
infected with Trojan.InstallCore.1151, Trojan.InstallCore.61, Trojan.InstallCore.217, Trojan.InstallCore.53, Trojan.InstallCore.50
33.33%

Malwarebytes
PUP.Optional.Installcore, PUP.Optional.DownloadExpert, PUP.Optional.InstallCore
28.89%

ESET NOD32
Win32/InstallCore.WQ potentially unwanted application, Win32/InstallCore.XM potentially unwanted application, Win32/InstallCore.TC potentially unwanted application
26.67%

herdProtect (fuzzy)
a variant of b7970a230a924979d0a7a701d1535ae8c04dc86d, a variant of 336bafb104eda68b0ac069ddece71dc42790a0f7, a variant of 006b3b58ee3021a3b8432a4e0d338fbdae168496
26.67%

VIPRE Antivirus
Threat.4150696, Threat.4786018, Threat.4729122
22.22%

Avira AntiVirus
Adware/InstallCore.A.242, Adware/InstallCo.zlz, Adware/InstallCo.nij, TR/Trash.Gen, ADWARE/InstallCore.Gen4, PUA/InstallCore.diur
22.22%

Vba32 AntiVirus
Malware-Cryptor.InstallCore.gen
20.00%

K7 AntiVirus
Trojan , Adware
20.00%

AVG
Generic, Adware InstallCore
20.00%

Bkav FE
W32.HfsAdware
17.78%

NANO AntiVirus
Riskware.Win32.InstallCore.drfvwt, Riskware.Win32.InstallCore.dfgovy, Riskware.Win32.InstallCore.djeemp
15.56%

ESET NOD32
Win32/InstallCore.TP potentially unwanted (variant)
11.11%

Comodo Security
Application.Win32.InstallCore.DSZ, Application.Win32.InstallCore.DE, Application.Win32.InstallCore.DSW
11.11%

McAfee
Trojan.Artemis!EC40F5C01761, Trojan.Artemis!C556B1220966, Trojan.Artemis!75C5EAA4C9BB
11.11%

The domain cdn.downloadbfiles.net has been seen to resolve to the following 15 IP addresses.

ec2-52-27-76-57.us-west-2.compute.amazonaws.com
May 21, 2016

ec2-54-186-139-41.us-west-2.compute.amazonaws.com
January 4, 2016

ec2-54-191-250-3.us-west-2.compute.amazonaws.com
December 7, 2015

ec2-52-10-176-223.us-west-2.compute.amazonaws.com
October 6, 2015

ec2-54-218-9-198.us-west-2.compute.amazonaws.com
August 21, 2015

ec2-52-26-172-249.us-west-2.compute.amazonaws.com
August 14, 2015

ec2-54-186-184-17.us-west-2.compute.amazonaws.com
August 13, 2015

ec2-54-186-33-198.us-west-2.compute.amazonaws.com
August 12, 2015

ec2-52-25-88-134.us-west-2.compute.amazonaws.com
July 23, 2015

ec2-54-201-218-17.us-west-2.compute.amazonaws.com
July 23, 2015

ec2-54-171-1-146.eu-west-1.compute.amazonaws.com
May 4, 2015

ec2-54-76-211-110.eu-west-1.compute.amazonaws.com
May 4, 2015

ec2-54-171-47-185.eu-west-1.compute.amazonaws.com
May 4, 2015

ec2-54-148-73-114.us-west-2.compute.amazonaws.com
May 4, 2015

ec2-54-200-107-209.us-west-2.compute.amazonaws.com
May 4, 2015

File downloads found at URLs served by cdn.downloadbfiles.net.

 
Latest 30 of 77 download URLs

The following file have been seen to comunicate with cdn.downloadbfiles.net in live environments.