home

download-fun.com

Privacy Protection Service INC d/b/a PrivacyProtect.org  (Proxy Registrant)

Domain Information

The domain download-fun.com is registered by proxy through PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM and was originally registered in August of 2014. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Ashburn, Virginia within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform.
Registrar:
PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM

Server location:
Virginia, United States (US)

Create date:
Monday, August 18, 2014

Expires date:
Thursday, August 18, 2016

Updated date:
Tuesday, July 28, 2015

ASN:
AS14618 AMAZON-AES - Amazon.com, Inc.,US

Whois:
2 download-fun.com records

Scanner detections:
Detections  (92% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Installer.NewMedia.Installer, PUP.installCore.Program.Installer.Meta (M), PUP.NewMedia.NMH.installCore.Installer (M), PUP.InstallCore.S (M), PUP.InstallCore.RES (M), PUP.InstallCore.Internet.Installer.Meta (M)
100.00%

Dr.Web
Trojan.InstallCore.576
9.09%

VIPRE Antivirus
Threat.4786018
9.09%

AVG
InstallCore
9.09%

The domain download-fun.com has been seen to resolve to the following 7 IP addresses.

209.99.40.223
209-99-40-223.fwd.datafoundry.com
September 3, 2016

54.84.143.69
ec2-54-84-143-69.compute-1.amazonaws.com
February 26, 2016

52.7.132.182
ec2-52-7-132-182.compute-1.amazonaws.com
February 26, 2016

107.23.203.23
ec2-107-23-203-23.compute-1.amazonaws.com
February 26, 2016

54.236.147.238
ec2-54-236-147-238.compute-1.amazonaws.com
May 21, 2015

54.84.140.114
ec2-54-84-140-114.compute-1.amazonaws.com
May 21, 2015

54.209.232.94
ec2-54-209-232-94.compute-1.amazonaws.com
May 21, 2015

File downloads found at URLs served by download-fun.com.

1 / 68      (PUP)
http://download-fun.com/?dl=1&pi=Ajg4NzcRNZi1OM==&osos=VdluDrW3cw==&dr=cHaWck13IKFy7Xam2r0Wc32lDXiyvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z15LyDj rcWDK4m7z0RvmiWAkDjIKiWXzL0OT7dOTMFASDPDdlChV8FAzMFAzc3AZaz&pd=2323Um5wcHAtDdV0UmNJ i==&campaignId=9jn0AjC0AzcdAZMq  (winrarsetup.exe)

1 / 68      (PUP)
http://download-fun.com/?dl=1&pi=ATA3OZCdAzLRAM==&osos=VdluDrW3cw==&chnl=b_sa_chwin8&dr=cHaWck1P2KxP7dl0eSD0 T1z2dVl2kDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWSVim7dREhKVuvmAWASDChTMm7dlChV83AzgdAjMROTnm7K2pDZ1fOTgwOTcwNjnyAw==&pd=2323UmD1 Q1E d2JUmNJ i==&campaignId=9jn0AzayAjiwAZMq  (audioeditorandrecordersetup.exe)

0 / 68
http://download-fun.com/?dl=1&pi=Ajg4NzcRNZi1OM==&osos=VdluDrW3cw==&dr=cHaWck1mIXvlDmW4vExthXN3DKV0AQDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWxnBm7dREhKVuvmAWASDChTMm7dlChV8FNzg3AzgwOTnm7K2pDZ1fNzgyATaROTn0Ag==&pd=2323UEvP2rLt2XNlUmNJ i==&campaignId=9jn0AjgzOTCwAZMq  (firefox setup 27.0.exe)

1 / 68      (PUP)
http://download-fun.com/?dl=1&pi=Ajg4NzcRNZAdAi==&osos=VdluDrW3cw==&dr=cHaWck13IKFy7Xam2r0Wc32lDXiyvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1sLQDj rcWDK4m7z0RvmiWAkDjIKiWXzM0OT7dOTMFASDPDdlChV83AzMFAzc3AZaz&pd=2323Um5wcHAtDdV0UmNJ i==&campaignId=9jn0AjgyNzAwAZMq  (winrarsetup.exe)

1 / 68      (PUP)
http://download-fun.com/?dl=1&pi=Ajg4NzcyAj7yAM==&osos=VdluDrW3cw==&dr=cHaWck10DK5t2mll2dVyvExthXN3DKV0AQDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWxVAm7dREhKVuvmAWASDChTMm7dlChV8RATg0OTgwOTnm7K2pDZ1fAZAFOZgyAza0Ag==&pd=2323UmDyDKVBDK2l mxPcECu7dWt&campaignId=9jn0Ajg1OTndAZMq  (teamviewersetup.exe)

1 / 68      (PUP)
http://download-fun.com/?dl=1&pi=Ajg4NzcyAZgzAw==&osos=VdluDrW3cw==&dr=cHaWck13IKFy7Xam2r0Wc32lDXimc3aW7mcmIT1zvm2yIKiWvmREhKDyvmNjhLDSvmNBDz1mcQDjhTnmDZ0wvmNpDZ1fAznFNj7FAZCRvm5EIKiWXzCzAjgzNzcwAjA=&pd=2323Um5wcHAtDdV0UmNJ i==&campaignId=9jn0Ajg1NjgyAZMq  (winrarsetup.exe)

1 / 68      (Adware)
http://download-fun.com/?dl=1&pi=ATa0NzARAzAdNg==&osos=VdluDrW3cw==&dr=cHaWck1j 3Vu2rVyUXN0cmlGDS1J mRp mLm2r0Wc32lDXidvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1VLyDj rcWDK4m7z0RvmiWAkDjIKiWXzgyNjnzAZnFASDPDdlChV8ROTAwATidATaz&pd=2323Um2yDK50UKtp miu7dWt&campaignId=9jn0Azn4ATL0AZMq  (counterstrikesetup.exe)

1 / 68      (PUP)
http://download-fun.com/?dl=1&pi=Ajg4NzcyAZgzAw==&osos=VdluDrW3cw==&dr=c3aW7mcm2r0Wc32lDXimcHaWck1E dWE rLtDK5y2rgmIT1zvm2yIKiWvmREhKVzvmNjhLVTvmNBDz1lcyDjhTnmDZ0wvmNpDZ1fNzCROZC4AZCRvm5EIKiWXzC1AZndNzAyNZa=&pd=2323UENJDEx37XvlUK2l2kFj d0=&campaignId=9jn0Ajg3Nzg4AZMq  (googleearthsetup.exe)

1 / 68      (PUP)
http://download-fun.com/?dl=1&pipi=Ajg4NzcRNZi1OM==&osos=VdluDrW3cw==&dr=cHaWck13IKFC 32zUK1J2mllUK1PIdVyvExthXN3DKV0vENyhKvEvmCWcyDEcmlChSDBDz1p2kDj7z1vVkDj rcWIXim7z0RvmiWAkDjIKiWXzAyOZ7dOTMFASDPDdlChV8dAjg1AZc3AZaz&pd=2323UmxJ2d4tcdWm2H2PcmLu7dWt&campaignId=9jn0Aj7FNji0AZMq  (windowsmoviemakersetup.exe)

1 / 68      (Adware)
http://download-fun.com/?dl=1&pi=AznzOZa0AZMzNw==&osos=VdluDrW3cw==&dr=cHaWck1jIHvJ KLm2r0Wc32lDXiyvENyhKvEvmCWcyDEcmlChSDBDz1w2kDj7z1kLQDj rcWcHim7z0RvmiWAkDjIKiWXz7zNjazOZMFASDPDdlChV83NTiwNzA4ATiy&pd=2323UExJck1EIXDlUmNJ i==&campaignId=9jn0AjCdAzMyAZMq  (googlechromesetup.exe)

1 / 68      (PUP)
http://download-fun.com/?dl=1&pi=ATc4Ajc1NZ7dNM==&osos=VdluDrW3cw==&dr=cHaWck10 3xP k1dIKxl y1j dFdDXv0DXam2r0Wc32lDXidvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1vTQDj rcWDK4m7z0RvmiWAkDjIKiWXzARNTcwAZnFASDPDdlChV84OZg4NTn1ATaz&pd=2323UmNJ dwtIrVyDSFj d0=&campaignId=9jn0AzawATg4AZMq  (ptotalvideoconvertersetup.exe)

4 / 68      (Adware)
http://download-fun.com/?dl=1&pi=ATLwOTC1AZizAi==&osos=VdluDrW3cw==&dr=cHaWck10 d10 d0tIrWtDSD0 T1z2dVl2Z7mc3aW7mcmIT1zvm2yIKiWvmREhKDyvmNjhLDSvmNBDz1mcQDjhTnmDZ0wvmNpDZ1fOTayNjLwATCRvm5EIKiWXzczNznyOZgRAjA=&pd=2323UmRp2mLtcrWwUmNJ i==&campaignId=9jn0Azn3OZAwAZMq  (tomtomhomesetup.exe)

The following 29 files have been seen to comunicate with download-fun.com in live environments.

TCP » 209.99.40.223:80
UCBrowser.exe (by UCWeb)

TCP » 209.99.40.223:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 209.99.40.223:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 209.99.40.223:80
jingling.exe

TCP » 209.99.40.223:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 209.99.40.223:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 209.99.40.223:80
hkcmd.exe (Intel Common User Interface by Intel)

TCP » 209.99.40.223:80
online-guardian-v2.0.9.exe

TCP » 209.99.40.223:80
svcspwin.exe (WinsPop Enterprise Super V 2.0 by agir)

TCP » 209.99.40.223:80
ContentFinder.exe (ContentFinder by ContentFinder Software)

TCP » 209.99.40.223:80
ContentFinder.exe (ContentFinder by DigitalSoftware Group)

TCP » 209.99.40.223:80
ContentSinder.exe (ContentSinder by ContentSinder Company)

TCP » 209.99.40.223:80
ContentFinder.exe (ContentFinder by ContentFinder Company)

TCP » 209.99.40.223:80
apptrailers.exe

TCP » 209.99.40.223:80
kmspico10.2.1__8174_il3.exe

TCP » 209.99.40.223:80
kmspico10.2.1__8174_il17.exe

TCP » 209.99.40.223:443
online-guardian.exe

TCP » 209.99.40.223:56666
emuletorrent.exe

TCP » 209.99.40.223:25
init.exe

TCP » 209.99.40.223:80
DTSRVC.exe (DTSRVC by Portrait Displays)

 
Latest 20 of 33 files

URL:
http://download-fun.com/

Google Analytics:
UA-53970844

Title:
“File-Opener”

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
nginx/1.4.7

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.