home

cleansoftclean.info

Privacy Protection Service INC d/b/a PrivacyProtect.org  (Proxy Registrant)

Domain Information

The domain cleansoftclean.info is registered by proxy through PDR Ltd. d/b/a PublicDomainRegistry.com. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Ashburn, Virginia within the United States. The domain uses the Amazon Web Services (AWS) cloud computing platform.
Registrar:
PDR Ltd. d/b/a PublicDomainRegistry.com

Server location:
Virginia, United States (US)

ASN:
AS14618 AMAZON-AES - Amazon.com, Inc.,US

Whois:
2 cleansoftclean.info records

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
(M), PUP.Installer.NewMedia.Installer, PUP.NewMedia.Installer.installCore.Installer (M), PUP.InstallCore.RES (M)
87.50%

avast!
Malware-gen
25.00%

VIPRE Antivirus
Threat.4786018, Threat.4150696
25.00%

herdProtect (fuzzy)
a variant of 6c324b8a586ce56310a4187a69e6e93e6136a20e, a variant of 5e4a1c943d2e583a10961269f18f8f7fbfe43806
25.00%

NANO AntiVirus
Trojan.Win32.Agent.dhbpge
12.50%

Bkav FE
W32.HfsAdware
12.50%

Dr.Web
Trojan.InstallCore.508
12.50%

ESET NOD32
Win32/InstallCore.YV potentially unwanted (variant)
12.50%

ESET NOD32
Win32/InstallCore.YL potentially unwanted application
12.50%

K7 AntiVirus
Adware
12.50%

Agnitum Outpost
Trojan.Badur
12.50%

Avira AntiVirus
PUA/InstallCore.A.11
12.50%

Trend Micro House Call
Suspicious_GEN.F47V0403
12.50%

Fortinet FortiGate
Riskware/InstallCore
12.50%

The domain cleansoftclean.info has been seen to resolve to the following 9 IP addresses.

54.165.159.105
ec2-54-165-159-105.compute-1.amazonaws.com
May 29, 2016

52.22.16.9
ec2-52-22-16-9.compute-1.amazonaws.com
May 29, 2016

52.0.81.237
ec2-52-0-81-237.compute-1.amazonaws.com
May 29, 2016

54.88.19.50
ec2-54-88-19-50.compute-1.amazonaws.com
February 27, 2016

52.71.119.31
ec2-52-71-119-31.compute-1.amazonaws.com
February 27, 2016

52.22.149.102
ec2-52-22-149-102.compute-1.amazonaws.com
February 27, 2016

107.23.103.247
ec2-107-23-103-247.compute-1.amazonaws.com
May 2, 2015

54.164.50.216
ec2-54-164-50-216.compute-1.amazonaws.com
May 2, 2015

54.210.63.134
ec2-54-210-63-134.compute-1.amazonaws.com
May 2, 2015

File downloads found at URLs served by cleansoftclean.info.

1 / 68      (PUP)
http://cleansoftclean.info/?dl=1&pi=Ajg4NzcyNTMRNM==&osos=VdluDrW3cw==&gclid=CjwKEAjwu72pBRC9hsn2-e34vRUSJACnSYsTuES7h4Ugz8WTnNUCiyFn3RlldiClPT6VdY7C2FFYcRoCQ4jw_wcB&dr=cHaWck1w 32lcEsJIKF0UXDpDX2lcQD0 T1z2dVl2ZCmc3aWc3vjvmCWcyDEcmlChSDBDz1l QDj7z1VLyDj rcWDK4m7z0RvmiWAkDjIKiWXzLzNjg1Nza0AQDPDdlChV81NTAwOZn1AZMRAg==&pd=DrW3 mRJ7KxE rW3UmNJ i==&campaignId=9jn0AjCyATM4AZMq  (powerpointviewersetup.exe)

1 / 68      (PUP)
http://cleansoftclean.info/?dl=1&pi=Ajg4NzcRAzizAM==&osos=VdluDrW3cw==&gclid=CPGm6c-OgMUCFZQlgQod_IcA5Q&dr=cHaWck1NIKFl73vPDEim2r0Wc32lDXiFvENyhXNy7yDphXAmD3vpDZ0m rcWcHim7dAWilam7dREhXs0vmAWASDChTMm7dlChV8zNz70ATL1NZam7K2pDZ1fAzn3AZ7RATi3Njn=&pd=IKFz2r5B k1zDKLu7dWt&campaignId=9jn0AjCzNjc0AZMq  (minecraftsetup.exe)

1 / 68      (PUP)
http://cleansoftclean.info/?dl=1&pi=Ajg4NzcyAZgzAw==&osos=VdluDrW3cw==&gclid=Cj0KEQjw6OOoBRDP9uG4oqzUv7kBEiQA0sRYBDoCEGIQxC_LZ3xsXfWPFmPHP942kBMMXIjhevWF-j0aAtfj8P8HAQ&dr=7Kxu T1Y73vl7Xxp2mVWvmCWcyDEcmlChSDBDz1l QDj7z1vTQDj rcWDK4m7z0RvmiWAkDjIKiWXziwAj7dNjAzAQDG2z1YIdVF2dWyDH0m XiWed1P2rNo2HlwDX0m K4We3sB7KNl KVu2H0m73iWe3xPcm2l2H0m EiWedlmidWu2rVu2ZpnfXtpDlNl7XvjIZpLfSDleHsyhXtP7dVpDH0m7XMWed5CcrWzIXxp dFWvmxdhXtCDXDp7dVWvENyhXNy7yD0 T1uDHi1vEsyhXMt2dluemlwvm5EIKiWXziwNZgdNTA0ATgR&pd=DrW3 Q1p EN07KRBcyFJcmc=&campaignId=9jn0Ajc3ATgdAZMq  (winzipsetup.exe)

1 / 68      (PUP)
http://cleansoftclean.info/?dl=1&pi=Ajg4NzcyAZC1Ni==&osos=VdluDrW3cw==&gclid=Cj0KEQjwpM2pBRChsZCzm_CU0t4BEiQAxDVFmpMPy4PNOTfQKCWPHsLqWixOCrhr0NQ2Bja4vN9hy2gaAs4e8P8HAQ&dr=cHaWck1mIXvlDmW4vExthXN3DKV0OSDzcj1zcmAmIT1zvm2yIKiWvmREhKVuvmNjhVsavmNBDz1l QDjhTnmDZ0wvmNpDZ1fAZn1AZA3ATgyvm5EIKiWXzMFAzM3NZg1Njny&pd=2323Um5j2rldDS1p EN07KRBcyF1cyFj d0=&campaignId=9jn0AjC0AzcdAZMq  (firefoxsetup.exe)

1 / 68      (Adware)
http://cleansoftclean.info/?dl=1&pi=Ajg4NzcRAzL3Aw==&osos=VdluDrW3cw==&gclid=CKuT7vHp3MQCFSLkwgoddjAA5g&dr=cHaWck1NIKFl73vPDEim2r0Wc32lDXiFvENyhXNy7yDphXAmD3vpDZ0m rcWDEam7dAWxlam7dREhKDyvmAWASDChTMm7dlChV8yOZ70OTnwOTam7K2pDZ1fAj71AZg1ATc4AZa=&pd= mW3UXNlDSFj d0=&campaignId=9jn0AjgRNT7wAZMq  (minecraftsetup.exe)

2 / 68      (Malware)
http://cleansoftclean.info/?dl=1&pi=NZM1Nza3AZnz&osos=VdluDrW3cw==&gclid=CI_K0-eNvcUCFdQRHwodY2oA7w&dr=cHaWck1NIKFl73vPDEim2r0Wc32lDXiFvENyhXNy7yDphXAmD3vpDZ0m rcWDK4m7dAWVVAm7dREhKVuvmAWASDChTMm7dlChV83OTc0NTLyOTam7K2pDZ1fNzc4OZnFNz73AZa=&pd=DrW3 mRJ7KxzUKvlDSFj d0=&campaignId=9jn0Azn0Nji0AZMq  (minecraftsetup.exe)

9 / 68      (PUP)
http://cleansoftclean.info/?dl=1&pi=Ajg4NzcROT7ROi==&osos=VdluDrW3cw==&gclid=CKrC_cTS2MQCFQmpaQodV2UASQ&dr=cHaWck1NIKFl73vPDEim2r0Wc32lDXiFvENyhXNy7yDphXAmD3vpDZ0m rcWDK4m7dAWVVAm7dREhKVuvmAWASDChTMm7dlChV8dOTawNZC4OZAm7K2pDZ1fNjAFOZg1NZc4OZn=&pd=DrW3 mRJ7KitcdVlUmNJ i==&campaignId=9jn0AjgwATawAZMq  (minecraftsetup.exe)

7 / 68      (Adware)
http://cleansoftclean.info/?dl=1&pi=Ajg4NzcyAjMdAM==&osos=VdluDrW3cw==&gclid=CKGq36bu7cQCFU_HtAodyzgArw&dr=cHaWck1mcmWz2H2pcmLm2r0Wc32lDXiFvENyhXNy7yDphXAmD3vpDZ0m rcWDK4m7dAWx0am7dREhKVuvmAWASDChTMm7dlChV8dNZLFAziwOZam7K2pDZ1fNjayAzg1AZ71Njn=&pd=DEVB k1E rW3UmWyDw==&campaignId=9jn0Ajg3NZnwAZMq  (frostwiresetup.exe)

URL:
http://cleansoftclean.info/

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
nginx/1.4.7

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.