» files.airdwnlds.com
Overview
Analysis
IPs Addresses (13)
Downloads (28)
Network (232)
Related Domains (15)

files.airdwnlds.com

Air Software (via a Proxy Registrant)

Domain Information

The domain files.airdwnlds.com is registered by proxy through ENOM, INC. and was originally registered in September of 2012. This domain has been known to host and distribute potentially unwanted software. The hosted servers are located in Chicago, Illinois within the United States which resides on the SingleHop, Inc. network. The domain is associated with the publisher Air Software who is located in Victoria, British Columbia in Canada.

Registrant:

WHOISGUARD, INC. on behalf of Air Software

Registrar:

ENOM, INC.

Server location:

Illinois, United States (US)

Create date:

Tuesday, September 11, 2012

Expires date:

Sunday, September 11, 2016

Updated date:

Wednesday, August 12, 2015

Root domain:

airdwnlds.com

Whois:

5 airdwnlds.com records

Scanner detections:

Detections (100% detected)

Scan engine

Details

Detections

Reason Heuristics

PUP.Air Software.AirSoftw.Bundler (M), PUP.Adknowledge.FUSIONIN.Bundler (M), PUP.Air Software (M), PUP.installCore (M)

100.00%

The domain files.airdwnlds.com has been seen to resolve to the following 13 IP addresses.

92.242.140.21

unallocated.barefruit.co.uk

June 19, 2015

108.168.218.35

108.168.218.35-static.reverse.softlayer.com

November 2, 2014

192.241.139.115

justice.airinstaller.com

September 7, 2014

173.192.195.228

173.192.195.228-static.reverse.softlayer.com

July 31, 2014

50.23.68.85

50.23.68.85-static.reverse.softlayer.com

June 12, 2014

184.154.116.114

chicago.airinstaller.com

April 16, 2014

162.243.2.91

empire.airinstaller.com

April 4, 2014

192.241.237.97

uswestmeganode1.airinstaller.com

February 27, 2014

173.192.195.226

173.192.195.226-static.reverse.softlayer.com

February 7, 2014

108.168.218.34

108.168.218.34-static.reverse.softlayer.com

February 6, 2014

192.241.231.245

babar.airinstaller.com

December 28, 2013

198.211.102.17

August 5, 2013

173.236.44.90

wind.airinstaller.com

July 29, 2013

File downloads found at URLs served by files.airdwnlds.com.

1 / 68 (Adware)

http://files.airdwnlds.com/get/click/.../?filename=Setup (setup.exe)

1 / 68 (Adware)

http://files.airdwnlds.com/get/click/.../?filename=Download (download.exe)

1 / 68 (Adware)

http://files.airdwnlds.com/get/click/.../?sid=199375_510&uid=363164746&filename=Setup (setup.exe)

1 / 68 (Adware)

http://files.airdwnlds.com/get/click/.../?uid=F610oa5JsO (setup.exe)

1 / 68 (Adware)

http://files.airdwnlds.com/get/click/.../?filename=Download (download.exe)

1 / 68 (Adware)

http://files.airdwnlds.com/get/click/.../?filename=Download (download.exe)

1 / 68 (Adware)

http://files.airdwnlds.com/get/click/.../?filename=Chrome (chrome.exe)

1 / 68 (Adware)

http://files.airdwnlds.com/get/click/.../?sid=199375_510&uid=360493806&filename=Setup (setup.exe)

1 / 68 (Adware)

http://files.airdwnlds.com/get/click/.../?sid=Chrome-AO-114806_none-ron_283709_570608&filename=Chrome_Setup (chrome_setup.exe)

1 / 68 (Adware)

http://files.airdwnlds.com/get/click/.../?filename=FlashPlayer (flashplayer.exe)

1 / 68 (Adware)

http://files.airdwnlds.com/get/click/.../?uid=XP10zWGkLC (setup.exe)

1 / 68 (Adware)

http://files.airdwnlds.com/get/click/.../ (setup.exe)

1 / 68 (Adware)

http://files.airdwnlds.com/get/click/.../?sid=Chrome-MT&filename=Chrome_Setup (chrome_setup.exe)

1 / 68 (Adware)

http://files.airdwnlds.com/get/click/.../?uid=wa10SQbRk9 (setup.exe)

1 / 68 (Adware)

http://files.airdwnlds.com/get/click/.../?uid=LI10bDOz95 (setup.exe)

1 / 68 (Adware)

http://files.airdwnlds.com/get/click/.../?filename=Browser_Update (browser_update.exe)

1 / 68 (Adware)

http://files.airdwnlds.com/get/click/.../?sid=Chrome-AO-114787_1365253-ron_283709_570608&filename=Chrome_Setup (chrome_setup.exe)

1 / 68 (Adware)

http://files.airdwnlds.com/get/click/.../?sid=Chrome-AO-114787_1263775-ron_283709_570608&filename=Chrome_Setup (chrome_setup.exe)

1 / 68 (Adware)

http://files.airdwnlds.com/get/click/.../?filename=Setup (setup.exe)

1 / 68 (Adware)

http://files.airdwnlds.com/get/click/.../?uid=3E10LONusD (setup.exe)

1 / 68 (Adware)

http://files.airdwnlds.com/get/click/.../?filename=Download (download.exe)

1 / 68 (Adware)

http://files.airdwnlds.com/get/click/.../?sid=199375_510&uid=362826378&filename=Setup (setup.exe)

1 / 68 (Adware)

http://files.airdwnlds.com/get/click/.../?filename=Setup (setup.exe)

1 / 68 (Adware)

http://files.airdwnlds.com/get/click/.../?sid=950&uid=155211813&filename=Internet_Explorer (internet_explorer.exe)

1 / 68 (Adware)

http://files.airdwnlds.com/get/click/.../?=58076&uid=OjU6NDg6MTY6mUhbyjoEUoYZV2BEXpLVCP6ZhAI9C0NatOMU4EMhPYRyBvlZikEKDYpyO-63Xl6VM-eqr_c4BC_mzOpBK1UaJw (setup.exe)

1 / 68 (Adware)

http://files.airdwnlds.com/get/click/.../?=58076&uid=OjU6NDg6MTY6Lh7o3fkbm8kSsgtlbdQStxMJt2iF_QweAZB9gL2QZIiU7gbi9qZxhO9u0ppiNSJjiO6TS58p2Iv9Lhf4BBapcw (setup.exe)

1 / 68 (Adware)

http://files.airdwnlds.com/get/click/.../?=58076&uid=OjU6NDg6MTY6dlp9j5memy_xpuENo0K_fwNSBD2R2Sq7MY5oWflY2lsjLREsxWM-Ng-r0pwI59Ccz475ZezN13E2m2Lr9Td58g (setup.exe)

1 / 68 (Adware)

http://files.airdwnlds.com/get/click/.../?filename=Download (download.exe)

The following 232 files have been seen to comunicate with files.airdwnlds.com in live environments.

TCP » 92.242.140.21:80

smelled.exe (Smelled)

TCP » 92.242.140.21:443

dca-monitoring.exe (Compete DCA Monitoring Tool by Compete)

TCP » 92.242.140.21:80

marini.exe (Marini)

TCP » 92.242.140.21:443

client.exe (ClientWrapper)

TCP » 92.242.140.21:80

thebrowser.exe (TheBrowser by Goobzo)

TCP » 92.242.140.21:443

dca-monitoring.exe (Compete DCA Monitoring Tool by Compete)

TCP » 92.242.140.21:443

WindowService.exe (WindowService)

TCP » 92.242.140.21:443

ciuninstall.exe

TCP » 92.242.140.21:1866

jutched.exe

TCP » 92.242.140.21:443

dca-monitoring.exe (Compete DCA Monitoring Tool by Compete)

TCP » 92.242.140.21:80

masterupdater.exe

TCP » 108.168.218.34:80

15ba9f94.exe (Google Talk by AirInstaller)

TCP » 173.192.195.228:80

setup.exe (Software Updater by AirInstaller)

TCP » 92.242.140.21:80

pricemeterexpress.crx

TCP » 92.242.140.21:80

chrome.crx

TCP » 92.242.140.21:80

app-center.crx

TCP » 92.242.140.21:80

ntp.crx

TCP » 92.242.140.21:80

3dayinvite.crx

TCP » 92.242.140.21:80

twitter.crx

TCP » 92.242.140.21:80

viewlater.crx

Latest 20 of 232 files

Related Domains

realfreedownloads.com

trustydownloads.com

software-updater.com

updaterspro.com

thanksfordownloading.com

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.