home

file-install-a.com

Privacy Protection Service INC d/b/a PrivacyProtect.org  (Proxy Registrant)

Domain Information

The domain file-install-a.com is registered by proxy through PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM and was originally registered in March of 2015. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Ashburn, Virginia within the United States. The domain uses the Amazon Web Services (AWS) cloud computing platform.
Registrar:
PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM

Server location:
Virginia, United States (US)

Create date:
Monday, March 2, 2015

Expires date:
Thursday, March 2, 2017

Updated date:
Sunday, February 21, 2016

ASN:
AS14618 AMAZON-AES - Amazon.com, Inc.,US

Whois:
2 file-install-a.com records

Scanner detections:
Detections  (93% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.installCore (M), PUP.NewMedia.NMH.installCore.Installer (M), PUP.Installer.Bundler.Installer.Meta (M), PUP.InstallCore.RES (M), PUP.installCore.Program.Installer.Meta (M)
100.00%

The domain file-install-a.com has been seen to resolve to the following 9 IP addresses.

54.165.159.105
ec2-54-165-159-105.compute-1.amazonaws.com
May 18, 2016

52.22.16.9
ec2-52-22-16-9.compute-1.amazonaws.com
May 18, 2016

52.0.81.237
ec2-52-0-81-237.compute-1.amazonaws.com
May 18, 2016

54.88.19.50
ec2-54-88-19-50.compute-1.amazonaws.com
April 10, 2016

52.71.119.31
ec2-52-71-119-31.compute-1.amazonaws.com
April 10, 2016

52.22.149.102
ec2-52-22-149-102.compute-1.amazonaws.com
April 10, 2016

54.174.79.49
ec2-54-174-79-49.compute-1.amazonaws.com
January 4, 2016

54.165.201.145
ec2-54-165-201-145.compute-1.amazonaws.com
January 4, 2016

54.165.16.203
ec2-54-165-16-203.compute-1.amazonaws.com
January 4, 2016

File downloads found at URLs served by file-install-a.com.

1 / 68      (PUP)
http://file-install-a.com/?dl=1&pi=Ajg4NzcROTnFAi==&osos=VdluDrW3cw==&gclid=CLH1mNO738QCFYUewwod4zsA6g&dr=cHaWck1mIXvlDmW4vExthXN3DKV0OSDzcj1zcmAmIT1zvm2yIKiWvmREhXxyvmNjhVxSvmNBDz10cQDjhTnmDZ0wvmNpDZ1fNzczNZa3NZLyvm5EIKiWXzc1AZMzNz73OZ7R&pd=DdWJDHxPIdLu 3vE&campaignId=9jn0AjgyNZ7wAZMq  (firefoxsetup.exe)

1 / 68      (PUP)
http://file-install-a.com/?dl=1&pi=Ajg4NzcyATgRAi==&osos=VdluDrW3cw==&gclid=CNX4_7jt_8QCFZUdgQodin0ALg&dr=cHaWck1NIKFl73vPDEim2r0Wc32lDXiFvENyhXNy7yDphXAmD3vpDZ0m rcWDK4m7dAWVVAm7dREhKVuvmAWASDChTMm7dlChV8dNTMwNZC4OZAm7K2pDZ1fNjAzAZg0NZc4OZn=&pd=DrW3 mRJ7KitcdVlUmNJ i==&campaignId=9jn0AjCzNTg0AZMq  (minecraftsetup.exe)

1 / 68      (PUP)
http://file-install-a.com/?dl=1&pi=Ajg4NzcRAjcFAg==&osos=VdluDrW3cw==&gclid=CL3z6_2JzsQCFZMvgQodrwwALQ&dr=cHaWck1NIKFl73vPDEim2r0Wc32lDXiFvENyhXNy7yDphXAmD3vpDZ0m rcWDK4m7dAWVVAm7dREhKVuvmAWASDChTMm7dlChV8dNTMwNZC4OZAm7K2pDZ1fNjcFOZ7zNZc4OZn=&pd=DrW3 mRJ7KitcdVlUmNJ i==&campaignId=9jn0AjcdNZg0AZMq  (minecraftsetup.exe)

1 / 68      (PUP)
http://file-install-a.com/?dl=1&pi=Ajg4NzcRAznyAM==&osos=VdluDrW3cw==&gclid=CLqpgrLa0MQCFUQ6gQodcb8AJg&dr=cHaWck1mIXvlDmW4vExthXN3DKV0OSDzcj1zcmAmIT1zvm2yIKiWvmREhXs0vmNjhLvSvmNBDz1w2kDjhTnmDZ0wvmNpDZ1fNTnFNZAzOTAyvm5EIKiWXzL1OTiwOT73NzMy&pd=Ir5wcHlt7KFFUmWyDw==&campaignId=9jn0Ajc3Azg0AZMq  (firefoxsetup.exe)

1 / 68      (PUP)
http://file-install-a.com/?dl=1&pi=Ajg4NzcRNZi1OM==&osos=VdluDrW3cw==&gclid=Cj0KEQjw6OOoBRDP9uG4oqzUv7kBEiQA0sRYBD8XGor-3IWE01R4BR81L5tdNbv-_pWurVrh6ZCzm2AaAiY_8P8HAQ&dr=7Kxu T1Y73vl7Xxp2mVWvmCWcyDEcmlChSDBDz1l QDj7z1vTQDj rcWDK4m7z0RvmiWAkDjIKiWXziwAj7dNjAzAQDG2z1YIdVF2dWyDH0m XiWed1P2rNo2HlwDX0m K4We3sB7KNl KVu2H0m73iWe3xPcm2l2H0m EiWedlmidWu2rVu2ZpnfXtpDlNl7XvjIZpLfSDleHsyhXtP7dVpDH0m7XMWed5CcrWzIXxp dFWvmxdhXtCDXDp7dVWvENyhXNy7yD0 T1uDHi1vEsyhXMt2dluemlwvm5EIKiWXziyOTM3NTA0ATgR&pd=DrW3 Q1p EN07KRBcyFJcmc=&campaignId=9jn0Ajc3AT74AZMq  (winzipsetup.exe)

1 / 68      (PUP)
http://file-install-a.com/?dl=1&pi=Ajg4NzcROZnzOi==&osos=VdluDrW3cw==&gclid=CI-br8SXgMUCFVYUjgodcL8ArA&dr=cHaWck10DK5t2mll2dVyvExthXN3DKV0OSDzcj1zcmAmIT1zvm2yIKiWvmREhKVuvmNjhLlOvmNBDz1l QDjhTnmDZ0wvmNpDZ1fNZg4Nji0AZCyvm5EIKiWXzidOTcyOZazNZny&pd=DEvlcdgt7dRPc3NFUmWyDw==&campaignId=9jn0AjCzNznwAZMq  (teamviewersetup.exe)

1 / 68      (Adware)
http://file-install-a.com/?dl=1&pi=Ajg4NzcRNZi3Ai==&osos=VdluDrW3cw==&gclid=CKnW6LHPycQCFdcRgQodrkkAdA&dr=cHaWck1mcmWz2H2pcmLm2r0Wc32lDXiFvENyhXNy7yDphXAmD3vpDZ0m rcWDK4m7dAWVVAm7dREhKVuvmAWASDChTMm7dlChV8yNZi4NTARNzam7K2pDZ1fAjM0Aj7FNZcwAZa=&pd=7dRl7K4tDKFq 3Cu7dWt&campaignId=9jn0Ajc0OTL0AZMq  (frostwiresetup.exe)

1 / 68      (PUP)
http://file-install-a.com/?dl=1&pi=Ajg4NzcRAzc0OM==&osos=VdluDrW3cw==&gclid=Cj0KEQjwi-moBRDL4Omf9d_LndMBEiQAQtFf84RVqY5nxJYx0oaln3z0xbyS0XcnpIzs-WaS0ATixuQaApZF8P8HAQ&dr=cHaWck1mcmWz2H2pcmLm2r0Wc32lDXiFvENyhXNy7yDphXAmD3vpDZ0m rcWDK4m7dAWVVAm7dREhKVuvmAWASDChTMm7dlChV8yAjA4NTARNzam7K2pDZ1fAj71AjLFNZcwAZa=&pd=7dRl7K4tDKFq 3Cu7dWt&campaignId=9jn0Ajc4NZgyAZMq  (frostwiresetup.exe)

1 / 68      (PUP)
http://file-install-a.com/?dl=1&pi=ATLFNzgFAZMyNw==&osos=VdluDrW3cw==&gclid=CN65pY71hsUCFTQatAodSl4AdA&dr=cHaWck1p ExlcmFl2k1leHsB 3vlcQD0 T1z2dVl2ZCmc3aWc3vjvmCWcyDEcmlChSDBDz1lcyDj7z15LyDj rcWDXAm7z0RvmiWAkDjIKiWXzM0NTiROZM4AQDPDdlChV8wAji1NZc1NTcwAg==&pd=cd1p rLtIKFz2r5B kFJcmc=&campaignId=9jn0AjCdAZn0AZMq  (internetexplorersetup.exe)

1 / 68      (PUP)
http://file-install-a.com/?dl=1&pi=Ajg4NzcRNjM3Aw==&osos=VdluDrW3cw==&gclid=CIeM5NC9zcQCFe7MtAod4H0Axg&dr=cHaWck1w 3sj 3vuUXxp KLm2r0Wc32lDXiFvENyhXNy7yDphXAmD3vpDZ0m rcWDK4m7dAWTCwm7dREhKVuvmAWASDChTMm7dlChV8wAjcRNjnwNjam7K2pDZ1fAZM0ATLdNzMRAja=&pd=7XswUXNu 3cu7dWt&campaignId=9jn0AjcdAjgdAZMq  (popcorntimesetup.exe)

1 / 68      (Adware)
http://file-install-a.com/?dl=1&pi=Ajg4NzcyATa4OM==&osos=VdluDrW3cw==&gclid=CMfuueGE38QCFQiWtAodUUoAQQ&dr=cHaWck1JcrVu dDmIKNlvExthXN3DKV0OSDzcj1zcmAmIT1zvm2yIKiWvmREhKDyvmNjhLDSvmNBDz1mcQDjhTnmDZ0wvmNpDZ1fOTMzOTgzATcyvm5EIKiWXzCdNjcRNzg1NZCR&pd=eKVzUKluc3xP rwu7dWt&campaignId=9jn0AjgyAzndAZMq  (openofficesetup.exe)

1 / 68      (Adware)
http://file-install-a.com/?dl=1&pi=Ajg4NzcRNzA4Ni==&osos=VdluDrW3cw==&gclid=CKyM1OmxzsQCFWfmwgodZBkAww&dr=cHaWck1j7dRl7KFlcQD0 T1z2dVl2ZCmc3aWc3vjvmCWcyDEcmlChSDBDz1mcQDj7z1rLQDj rcWDEam7z0RvmiWAkDjIKiWXzc0NzMwOZi0AQDPDdlChV83AZnyAZLFAzcwAg==&pd=DdWP k1C 32uUmNJ i==&campaignId=9jn0AjcdNTCyAZMq  (ccleanersetup.exe)

0 / 68
http://file-install-a.com/?dl=1&pi=Ajg4NzcRAzazAM==&osos=VdluDrW3cw==&gclid=CPbOlf3j78QCFQwcaQodF6sA5A&dr=cHaWck1JcrVu dDmIKNlvExthXN3DKV0OSDzcj1zcmAmIT1zvm2yIKiWvmREhKVuvmNjhVVTvmNBDz1l QDjhTnmDZ0wvmNpDZ1fAT7FNZAROTAyvm5EIKiWXzn0AjC4NTCdNjgR&pd=2r8tD3vl7Xiu7dWt&campaignId=9jn0Ajg4AZcdAZMq  (apache_openoffice_4.1.0_win_x86_install_en-us.exe)

1 / 68      (PUP)
http://file-install-a.com/?dl=1&pi=Ajg4NzcRAzazAM==&osos=VdluDrW3cw==&gclid=CPbOlf3j78QCFQwcaQodF6sA5A&dr=cHaWck1JcrVu dDmIKNlvExthXN3DKV0OSDzcj1zcmAmIT1zvm2yIKiWvmREhKVuvmNjhVVTvmNBDz1l QDjhTnmDZ0wvmNpDZ1fAT7FNZAROTAyvm5EIKiWXzn0AjC4NTCdNjgR&pd=2r8tD3vl7Xiu7dWt&campaignId=9jn0Ajg4AZcdAZMq  (openofficesetup.exe)

URL:
http://file-install-a.com/

Title:
“File-Opener”

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
nginx/1.4.7

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.