downloader.inbox2me.com

Domains By Proxy, LLC  (Proxy Registrant)

Domain Information

The domain downloader.inbox2me.com is registered by proxy through GODADDY.COM, LLC and was originally registered in April of 2013. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Scottsdale, Arizona within the United States which resides on the GoDaddy.com, LLC network.
Registrar:
GODADDY.COM, LLC

Server location:
Arizona, United States (US)

Create date:
Wednesday, April 10, 2013

Expires date:
Sunday, April 10, 2016

Updated date:
Friday, May 01, 2015

ASN:
AS26496 AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC,US

Root domain:

Scanner detections:
Detections  (97% detected)

Scan engine
Details
Detections

ESET NOD32
Win32/InstallCore.BY potentially unwanted application, Win32/InstallCore.BL potentially unwanted application, Win32/InstallCore.BX potentially unwanted application
68.57%

Reason Heuristics
PUP.Installer.QuickDownloader.N, PUP.Adlogica.QuickDownloader.Bundler (M), PUP.installCore.SecureInstaller.Installer (M), PUP.Adknowledge.PremiumInstaller.Installer (M), PUP.Adlogica.QuickDow.Bundler (M), PUP.installCore.SecureIn.Installer (M)
60.00%

Dr.Web
Adware.InstallCore.133, Trojan.Packed.24524, Adware.InstallCore.86, Adware.InstallCore.122, Trojan.MulDrop5.10078, Trojan.Crossrider1.49350
54.29%

VIPRE Antivirus
InstallCore, Threat.4786018, Threat.4150696
51.43%

Sophos
Install Core, PUA.Install Core, PUA 'Install Core'
42.86%

avast!
Win32:Adware-gen [Adw], Win32:OutBrowse-CH [PUP]
42.86%

F-Prot
W32/InstallCore.R3.gen, W32/InstallCore.R.gen, W32/A-dbe1ec51
34.29%

Microsoft Security Essentials
Threat.Undefined, SoftwareBundler:Win32/OutBrowse
31.43%

K7 Gateway Antivirus
Unwanted-Program , Adware
25.71%

K7 AntiVirus
Unwanted-Program , Adware
25.71%

Avira AntiVirus
ADWARE/InstallCore.Gen7, Adware/InstallCo.HB, PUA/InstallCore.Gen7, ADWARE/InstallCo.HB
25.71%

Vba32 AntiVirus
Downware.InstallCore
25.71%

AVG
Adware Generic5.BDFT, Adware InstallCore.VU, OutBrowse, Generic_c
25.71%

Rising Antivirus
PE:Malware.XPACK-LNR/Heur!1.5594, PE:Malware.InstallCore!6.4, PE:Malware.InstallCore!6.4 [F]
22.86%

Kingsoft AntiVirus
Win32.Troj.Generic.a.(kcloud)
17.14%

The domain downloader.inbox2me.com has been seen to resolve to the following 8 IP addresses.

192.230.92.93.ip.incapdns.net
August 24, 2016

199.83.132.93.ip.incapdns.net
June 25, 2016

June 2, 2016

ip-50-63-202-54.ip.secureserver.net
April 17, 2016

July 1, 2015

July 1, 2015

April 23, 2014

April 23, 2014

File downloads found at URLs served by downloader.inbox2me.com.

 
Latest 30 of 36 download URLs

The following 222 files have been seen to comunicate with downloader.inbox2me.com in live environments.

 
Latest 20 of 222 files

URL:
http://downloader.inbox2me.com/

SSL certificate subject:
CN=sni43646.cloudflaressl.com, OU=PositiveSSL Multi-Domain, OU=Domain Control Validated

SSL certificate issuer:
CN=COMODO ECC Domain Validation Secure Server CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Web server:
cloudflare-nginx