home

cleansoftclean.com

Privacy Protection Service INC d/b/a PrivacyProtect.org  (Proxy Registrant)

Domain Information

The domain cleansoftclean.com is registered by proxy through PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM and was originally registered in February of 2015. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Ashburn, Virginia within the United States. The domain uses the Amazon Web Services (AWS) cloud computing platform.
Registrar:
PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM

Server location:
Virginia, United States (US)

Create date:
Sunday, February 15, 2015

Expires date:
Wednesday, February 15, 2017

Updated date:
Wednesday, February 10, 2016

ASN:
AS14618 AMAZON-AES - Amazon.com, Inc.,US

Whois:
2 cleansoftclean.com records

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Bundler.InstallCore, PUP.installCore (M), PUP.InstallCore.S (M), PUP.InstallCore.RES (M)
87.50%

avast!
Trojan-gen, Malware-gen
25.00%

ESET NOD32
Win32/InstallCore.ZC potentially unwanted (variant), Win32/InstallCore.YW potentially unwanted (variant)
25.00%

Trend Micro House Call
Suspicious_GEN.F47V0514, Suspicious_GEN.F47V0427
25.00%

Comodo Security
Application.Win32.InstallCore.PK, Application.Win32.InstallCore.AZC
25.00%

Baidu Antivirus
Adware.Win32.InstallCore
25.00%

herdProtect (fuzzy)
a variant of b62dd5e0036bd7c9635cdd5473fbfb71fc852b38, a variant of 78d996c48a592411b0d115706f6a480ae1425bca
25.00%

Malwarebytes
PUP.Optional.InstallCore.A
12.50%

G Data
Win32.Application.InstallCore.EG
12.50%

Vba32 AntiVirus
Malware-Cryptor.InstallCore.gen
12.50%

The domain cleansoftclean.com has been seen to resolve to the following 12 IP addresses.

54.165.159.105
ec2-54-165-159-105.compute-1.amazonaws.com
May 16, 2016

52.22.16.9
ec2-52-22-16-9.compute-1.amazonaws.com
May 16, 2016

52.0.81.237
ec2-52-0-81-237.compute-1.amazonaws.com
May 16, 2016

54.88.19.50
ec2-54-88-19-50.compute-1.amazonaws.com
March 1, 2016

52.71.119.31
ec2-52-71-119-31.compute-1.amazonaws.com
March 1, 2016

52.22.149.102
ec2-52-22-149-102.compute-1.amazonaws.com
March 1, 2016

54.165.16.203
ec2-54-165-16-203.compute-1.amazonaws.com
August 17, 2015

54.174.79.49
ec2-54-174-79-49.compute-1.amazonaws.com
August 17, 2015

54.165.201.145
ec2-54-165-201-145.compute-1.amazonaws.com
August 17, 2015

107.23.103.247
ec2-107-23-103-247.compute-1.amazonaws.com
May 6, 2015

54.210.63.134
ec2-54-210-63-134.compute-1.amazonaws.com
May 6, 2015

54.164.50.216
ec2-54-164-50-216.compute-1.amazonaws.com
May 6, 2015

File downloads found at URLs served by cleansoftclean.com.

1 / 68      (PUP)
http://cleansoftclean.com/?dl=1&pi=ATayNzLFOZi1NM==&osos=VdluDrW3cw==&gclid=CPOzqqeth8UCFYg9gQodmz0AKQ&dr=cHaWck1mIXvlDmW4vExthXN3DKV0OSDzcj1zcmAmIT1zvm2yIKiWvmREhKVuvmNjhVVTvmNBDz1l QDjhTnmDZ0wvmNpDZ1fOTgwNTgRAZcyvm5EIKiWXzCyATiwAzA3AT7R&pd=IKFz2r5B rDpcEN0UmNJ i==&campaignId=9jn0AjCdATcdAZMq  (firefoxsetup.exe)

1 / 68      (PUP)
http://cleansoftclean.com/?dl=1&pi=Ajg4NzcRNZAdAi==&osos=VdluDrW3cw==&gclid=CJavmJ6F_sQCFUc2gQodwYYAPw&dr=cHaWck1mIXvlDmW4vExthXN3DKV0OSDzcj1zcmAmIT1zvm2yIKiWvmREhXs0vmNjhLvSvmNBDz1w2kDjhTnmDZ0wvmNpDZ1fAZC3AZL3ATgyvm5EIKiWXzM1NTL0OZAdNjny&pd=7KN0IXDlUKluc3xP rRzUEVzUmNJ i==&campaignId=9jn0AjCyOTcyAZMq  (firefoxsetup.exe)

1 / 68      (PUP)
http://cleansoftclean.com/?dl=1&pi=Ajg4NzcRNZAFNw==&osos=VdluDrW3cw==&gclid=COim1eL1-sQCFdgJgQodHg8AWg&dr=cHaWck1mIXvlDmW4vExthXN3DKV0OSDzcj1zcmAmIT1zvm2yIKiWvmREhXs0vmNjhLvSvmNBDz1w2kDjhTnmDZ0wvmNpDZ1fAzA0Azc0AjLyvm5EIKiWXzA3NZiyNjC1OZny&pd=IKFz2r5B k1mIXvz2kFj d0=&campaignId=9jn0AjCROZCyAZMq  (firefoxsetup.exe)

1 / 68      (PUP)
http://cleansoftclean.com/?dl=1&pi=Ajg4NzcRNzg0Ni==&osos=VdluDrW3cw==&gclid=CIr2-9WTgMUCFYM8gQodXVkAgA&dr=cHaWck1mIXvlDmW4vExthXN3DKV0OSDzcj1zcmAmIT1zvm2yIKiWvmREhXs0vmNjhLvSvmNBDz1w2kDjhTnmDZ0wvmNpDZ1fAZcdAZL3ATgyvm5EIKiWXzMzNZL0OZAdNjny&pd=7KN0IXDlUKluc3xP rRzUEVzUmNJ i==&campaignId=9jn0AjCzNjCyAZMq  (firefoxsetup.exe)

1 / 68      (PUP)
http://cleansoftclean.com/?dl=1&pi=ATLwAzndAZa0Oi==&osos=VdluDrW3cw==&gclid=CPGvjfvLgsUCFfQZtAodJBgARg&dr=cHaWck1q7XDPvExthXN3DKV0OSDzcj1zcmAmIT1zvm2yIKiWvmREhKVuvmNjhVsLvmNBDz1l QDjhTnmDZ0wvmNpDZ1fNZ7FAjidNZiyvm5EIKiWXzidOT7RNTnzNjgR&pd=DEVB HCt7mVz2kFJcmc=&campaignId=9jn0AjC0NTA4AZMq  (javaruntimeenvironmentsetup.exe)

1 / 68      (PUP)
http://cleansoftclean.com/?dl=1&pi=Ajg4NzcRNZAdAi==&osos=VdluDrW3cw==&gclid=CJ3r-oq788QCFfNZ7AodvkYAeg&dr=cHaWck1mIXvlDmW4vExthXN3DKV0OSDzcj1zcmAmIT1zvm2yIKiWvmREhXs0vmNjhLvSvmNBDz1w2kDjhTnmDZ0wvmNpDZ1fAZnFAZL3ATgyvm5EIKiWXzM3NjL0OZAdNjny&pd=7KN0IXDlUKluc3xP rRzUEVzUmNJ i==&campaignId=9jn0AjgFAzAdAZMq  (firefoxsetup.exe)

9 / 68      (PUP)
http://cleansoftclean.com/?dl=1&pi=Ajg4NzcyATA3Ng==&osos=VdluDrW3cw==&gclid=CJilm8TK4cQCFVTLtAod61gA7w&dr=cHaWck1NIKFl73vPDEim2r0Wc32lDXiFvENyhXNy7yDphXAmD3vpDZ0m rcWDK4m7dAWx0am7dREhKVuvmAWASDChTMm7dlChV8FNZa4AZc1Njam7K2pDZ1fOTa3AzLFNjLFNTn=&pd=IKFz2r5B HNlDSFj d0=&campaignId=9jn0AjgzATC4AZMq  (minecraftsetup.exe)

7 / 68      (PUP)
http://cleansoftclean.com/?dl=1&pi=AzMFAjg0NZARNi==&osos=VdluDrW3cw==&gclid=CjwKEAjwx9KpBRCAiZ_tgYKWvhQSJABQjGW-jLD3Se-rHmbL6mS1Vsqw5y3vAwOfohM01-JAzpZxMhoChPzw_wcB&dr=cHaWck147m1jvExthXN3DKV0OSDzcj1zcmAmIT1zvm2yIKiWvmREhKVuvmNjhVVTvmNBDz1l QDjhTnmDZ0wvmNpDZ1fAz74AT71NTAyvm5EIKiWXzA0AziFATLFNj7R&pd=IKFz2r5B rPPcHsFUmWyDw==&campaignId=9jn0AjC1Azg0AZMq  (xbmcsetup.exe)

URL:
http://cleansoftclean.com/

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
nginx/1.4.7

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.