home

download.windowswally.com

Solvusoft Corporation

Domain Information

The domain download.windowswally.com registered by Solvusoft Corporation was initially registered in May of 2012 through GODADDY.COM, LLC. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Seattle, Washington within the United States which resides on the Amazon.com, Inc. network. The domain uses the Amazon Cloudfront CDN service which utilizes a number of proxy IP Addresses (see below).
Registrar:
GODADDY.COM, LLC

Server location:
Washington, United States (US)

Create date:
Saturday, May 26, 2012

Expires date:
Thursday, May 26, 2016

Updated date:
Thursday, April 16, 2015

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
windowswally.com

Whois:
2 windowswally.com records

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Win.Reputation.SolvusoftCorporation
100.00%

The domain download.windowswally.com has been seen to resolve to the following 16 IP addresses.

204.246.169.90
server-204-246-169-90.jfk1.r.cloudfront.net
May 4, 2015

54.230.38.184
server-54-230-38-184.jfk1.r.cloudfront.net
May 4, 2015

54.230.38.172
server-54-230-38-172.jfk1.r.cloudfront.net
May 4, 2015

54.192.36.128
server-54-192-36-128.jfk1.r.cloudfront.net
May 4, 2015

204.246.169.59
server-204-246-169-59.jfk1.r.cloudfront.net
May 4, 2015

54.230.37.121
server-54-230-37-121.jfk1.r.cloudfront.net
May 4, 2015

54.230.39.245
server-54-230-39-245.jfk1.r.cloudfront.net
May 4, 2015

54.230.39.68
May 4, 2015

54.230.17.49
server-54-230-17-49.iad12.r.cloudfront.net
September 4, 2014

54.230.17.10
server-54-230-17-10.iad12.r.cloudfront.net
September 4, 2014

54.230.16.233
server-54-230-16-233.iad12.r.cloudfront.net
September 4, 2014

54.230.16.212
server-54-230-16-212.iad12.r.cloudfront.net
September 4, 2014

54.230.18.172
server-54-230-18-172.iad12.r.cloudfront.net
September 4, 2014

54.230.18.24
server-54-230-18-24.iad12.r.cloudfront.net
September 4, 2014

54.230.17.217
server-54-230-17-217.iad12.r.cloudfront.net
September 4, 2014

54.230.17.210
server-54-230-17-210.iad12.r.cloudfront.net
September 4, 2014

File downloads found at URLs served by download.windowswally.com.

1 / 68      (PUP)
http://download.windowswally.com/downloads/.../WinThruster_2014.exe  (winthruster_2013.exe)

1 / 68      (PUP)
http://download.windowswally.com/downloads/.../WinThruster_2013.exe  (c7969516d87176867bd5ae772967006f)

The following 47 files have been seen to comunicate with download.windowswally.com in live environments.

TCP » 54.192.36.128:443
online-guardian-v2.0.9.exe

TCP » 54.192.36.128:80
saber.exe

TCP » 54.192.36.128:80
cktSvc.exe (Uncheckit Module by EVANGEL TECHNOLOGY (HK) LIMITED)

TCP » 54.192.36.128:80
wfini.exe (Trend Service by Trend)

TCP » 54.230.37.121:443
apptrailers.exe

TCP » 54.192.36.128:443
apptrailers.exe

TCP » 54.192.36.128:80
saber.exe

TCP » 54.192.36.128:80
uncheckithelper.exe (Uncheckit Module by EVANGEL TECHNOLOGY (HK) LIMITED)

TCP » 54.192.36.128:443
online-guardian-v2.0.9.exe

TCP » 54.192.36.128:80
saber.exe

TCP » 54.192.36.128:80
winsaber.exe

TCP » 54.192.36.128:80
winsaber.exe

TCP » 54.192.36.128:80
safwaf.exe

TCP » 204.246.169.59:80
nsk4e02.tmp

TCP » 204.246.169.90:80
nst860.tmp

TCP » 204.246.169.90:80
nst407c.tmp

TCP » 204.246.169.90:80
nso2953.tmp

TCP » 204.246.169.90:80
nsa8f47.tmp

TCP » 204.246.169.90:80
nsvdee2.tmp

TCP » 204.246.169.90:80
nsge4eb.tmp

 
Latest 20 of 49 files

URL:
http://download.windowswally.com/

Network:
Amazon Cloudfront

Web server:
AmazonS3

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.