» dl.downloadverse.com
Overview
Analysis
IPs Addresses (6)
Downloads (14)
Network (1)
Related Domains (15)

dl.downloadverse.com

Air Software (via a Proxy Registrant)

Domain Information

The domain dl.downloadverse.com is registered by proxy through ENOM, INC. and was originally registered in January of 2013. This domain has been known to host and distribute potentially unwanted software. The hosted servers are located in New York City, New York within the United States which resides on the Digital Ocean, Inc. network. The domain is associated with the publisher Air Software who is located in Victoria, British Columbia in Canada.

Registrant:

WHOISGUARD, INC. on behalf of Air Software

Registrar:

ENOM, INC.

Server location:

New York, United States (US)

Create date:

Tuesday, January 29, 2013

Expires date:

Sunday, January 29, 2017

Updated date:

Wednesday, December 30, 2015

ASN:

AS14061 DIGITALOCEAN-ASN - Digital Ocean, Inc.

Root domain:

downloadverse.com

Whois:

5 downloadverse.com records

Scanner detections:

Detections (93% detected)

Scan engine

Details

Detections

Reason Heuristics

DownloadManager.AirSoftware.F, PUP.Installer.InstallManager.F, PUP.Installer.InstallerSetup.F, PUP.Optional.Installer.F, PUP.Bundler.Adknowledge, PUP.Adknowledge.InstallManager.Installer (M), PUP.Adknowledge.InstallM.Installer (M)

100.00%

AVG

Generic_r, BundleApp_r, LionSea Software co.

84.62%

Malwarebytes

PUP.Optional.AirInstaller, PUP.Optional.AirAdInstaller

76.92%

avast!

Win32:Installer-L [PUP], Adware-gen [Adw], Win32:Malware-gen, Win32:Adware-BZI [PUP]

76.92%

Dr.Web

Trojan.SMSSend.4766, Trojan.SMSSend.5502, Trojan.SMSSend.5514, Program.Unwanted.79, Trojan.SMSSend.5533, Trojan.SMSSend.5402

76.92%

VIPRE Antivirus

Iminent, Threat.4150696, Threat.4784938, Threat.4782985

76.92%

Avira AntiVirus

ADWARE/Adware.Gen

76.92%

K7 AntiVirus

Adware , Unwanted-Program

69.23%

Sophos

AirInstaller, PUA 'AirInstaller'

69.23%

Rising Antivirus

PE:PUF.Airinstall!1.9C4C

69.23%

IKARUS anti.virus

AdWare.Airinstall, PUA.AirAdInstaller

69.23%

F-Prot

W32/AirInstall.A8.gen, W32/A-6bcf410b

69.23%

Agnitum Outpost

Adware.Agent, PUA.AirAd

69.23%

G Data

Win32.Adware.Airadinstaller, Gen:Variant.Adware.Graftor.153852

69.23%

Vba32 AntiVirus

AdWare.AirAdInstaller

69.23%

The domain dl.downloadverse.com has been seen to resolve to the following 6 IP addresses.

192.241.139.115

justice.airinstaller.com

February 10, 2015

184.154.116.114

chicago.airinstaller.com

November 13, 2014

173.192.195.228

173.192.195.228-static.reverse.softlayer.com

September 27, 2014

192.241.237.97

uswestmeganode1.airinstaller.com

April 14, 2014

108.168.218.35

108.168.218.35-static.reverse.softlayer.com

February 7, 2014

50.23.68.85

50.23.68.85-static.reverse.softlayer.com

December 13, 2013

File downloads found at URLs served by dl.downloadverse.com.

1 / 68 (Adware)

http://dl.downloadverse.com/get/click/.../?uid=b2a0d697d7284d068bdeb32c341d73f2&sid=120729&filename=Setup (setup.exe)

1 / 68 (Adware)

http://dl.downloadverse.com/get/click/.../?uid=3e839316865546ab9115e154eb6b07ec&sid=120728&filename=Setup (setup.exe)

35 / 68 (Adware)

http://dl.downloadverse.com/get/click/.../?sid=117896&uid=f0788477e5494445a4bbb29cd75d38f8&filename=Setup (setup.exe)

35 / 68 (Adware)

http://dl.downloadverse.com/get/click/.../?uid=6af58afa4e114c55ab6b1fc17553515c&sid=4532&filename=Setup (setup.exe)

36 / 68 (Adware)

http://dl.downloadverse.com/get/click/.../?sid=120559&uid=9d2006ae22f5428fa7cd268a25cce67d&filename=Setup (setup.exe)

3 / 68 (PUP)

http://dl.downloadverse.com/get/click/.../?sid=120670&uid=8e6c0d6be7d1403ca6c71bedc487d68b&filename=Setup (setup.exe)

0 / 68

http://dl.downloadverse.com/get/click/.../?uid=6eea99ead6dc44eb86220619577e2b5a&sid=120728&filename=Setup (setup.exe)

7 / 68 (Adware)

http://dl.downloadverse.com/get/click/.../?uid=665ebcb1d24e448b94e78094179ddbda&sid=120728&filename=Setup (setup.exe)

29 / 68 (Adware)

http://dl.downloadverse.com/get/click/.../?uid=79c0d57120b043c58ae0c644963002d3&sid=4532&filename=Setup (setup.exe)

28 / 68 (Adware)

http://dl.downloadverse.com/get/click/.../?uid=6a0ebf1a29f2429298b2ef42cb3d7f74&sid=4532&filename=Setup (setup.exe)

30 / 68 (Adware)

http://dl.downloadverse.com/get/click/.../?filename=Setup (setup.exe)

31 / 68 (Adware)

http://dl.downloadverse.com/get/click/.../?filename=Setup (setup.exe)

31 / 68 (Adware)

http://dl.downloadverse.com/get/click/.../?filename=Setup (setup.exe)

31 / 68 (Adware)

http://dl.downloadverse.com/get/click/.../?filename=Setup (setup.exe)

The following file have been seen to comunicate with dl.downloadverse.com in live environments.

TCP » 173.192.195.228:80

setup.exe (Software Updater by AirInstaller)

Related Domains

realfreedownloads.com

trustydownloads.com

software-updater.com

updaterspro.com

thanksfordownloading.com

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.