files.download-nation.com

W3i, LLC  (via a Proxy Registrant)

Domain Information

download-nation.com is distributing modified installers which differ from the originals thta utilize the InstallIQ install manager that offers users adware, toolbars and various unwanted software during setup. The domain files.download-nation.com is registered by proxy through GODADDY.COM, LLC and was originally registered in July of 2011. This domain has been known to host and distribute potentially unwanted software. The hosted servers are located in Ashburn, Virginia within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Cloudfront CDN service which utilizes a number of proxy IP Addresses (see below). The domain is associated with the publisher W3i, LLC who is located in Sartell, Minnesota in the United States.
Remove Malware from files.download-nation.com - Powered by Reason Core Security
Registrar:
GODADDY.COM, LLC

Server location:
Virginia, United States (US)

Create date:
Saturday, July 02, 2011

Expires date:
Wednesday, July 02, 2014

Updated date:
Wednesday, July 03, 2013

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Trend Micro House Call
TROJ_GEN.F47V1219, HV_INSTALLIQ_CA0836BD.TOMC
100.00%

Sophos
InstallQ
100.00%

Dr.Web
Adware.W3i.9
100.00%

VIPRE Antivirus
InstallIQ Installer
100.00%

ESET NOD32
Win32/InstallIQ (variant)
100.00%

Malwarebytes
PUP.Optional.InstallIQ.A
100.00%

Baidu Antivirus
Trojan.Win32.InstallIQ
100.00%

Reason Heuristics
PUP.Installer.W3i.H, PUP.Installer.W3i.N
100.00%

K7 Gateway Antivirus
Unwanted-Program
100.00%

K7 AntiVirus
Unwanted-Program
100.00%

Emsisoft Anti-Malware
Riskware.Win32.InstallIQ.AMN, Win32.Sality
100.00%

Boost by Reason
Adware.Installer.W3i.H
66.67%

McAfee
Artemis!12CBEBF2C718
66.67%

McAfee Web Gateway
Artemis!12CBEBF2C718
66.67%

herdProtect (fuzzy)
a variant of 09c1306944d5d439ec749ac983ecd38e85034fff, a variant of 972e5c1c6bbdc3c2e5cb7b9c1f3f545ca9506ccb
66.67%

The domain files.download-nation.com has been seen to resolve to the following 24 IP addresses.

server-54-230-39-102.jfk1.r.cloudfront.net
April 11, 2014

server-54-230-38-85.jfk1.r.cloudfront.net
April 11, 2014

server-54-230-38-186.jfk1.r.cloudfront.net
April 11, 2014

server-204-246-169-54.jfk1.r.cloudfront.net
April 11, 2014

server-54-230-39-15.jfk1.r.cloudfront.net
April 11, 2014

server-54-230-36-211.jfk1.r.cloudfront.net
April 11, 2014

server-54-230-37-203.jfk1.r.cloudfront.net
April 11, 2014

server-204-246-169-180.jfk1.r.cloudfront.net
April 11, 2014

server-54-230-51-46.jfk5.r.cloudfront.net
August 17, 2013

server-54-230-51-164.jfk5.r.cloudfront.net
August 17, 2013

server-205-251-251-38.jfk5.r.cloudfront.net
August 17, 2013

server-54-230-49-58.jfk5.r.cloudfront.net
August 17, 2013

server-54-230-48-161.jfk5.r.cloudfront.net
August 17, 2013

server-54-230-50-123.jfk5.r.cloudfront.net
August 17, 2013

server-54-230-50-162.jfk5.r.cloudfront.net
August 17, 2013

server-54-230-49-99.jfk5.r.cloudfront.net
August 17, 2013

server-54-230-22-52.ewr2.r.cloudfront.net
August 11, 2013

server-54-230-23-83.ewr2.r.cloudfront.net
August 11, 2013

server-54-230-20-62.ewr2.r.cloudfront.net
August 11, 2013

server-54-230-23-14.ewr2.r.cloudfront.net
August 11, 2013

server-54-230-22-124.ewr2.r.cloudfront.net
August 11, 2013

server-54-230-23-50.ewr2.r.cloudfront.net
August 11, 2013

server-54-230-20-181.ewr2.r.cloudfront.net
August 11, 2013

server-54-230-22-39.ewr2.r.cloudfront.net
August 11, 2013

File downloads found at URLs served by files.download-nation.com.

19 / 68    (Adware)

15 / 68    (Adware)
http://files.download-nation.com/gimp_a0.exe  (12cbebf2c718b2443fdea3adf1c0000e)

15 / 68    (Adware)
http://files.download-nation.com/wifi_a0.exe  (6dd9ec87d2887aae066ccf66ed2bbf72)

The following 9 files have been seen to comunicate with files.download-nation.com in live environments.

URL:
http://files.download-nation.com/

Network:
Amazon Cloudfront

Web server:
AmazonS3

Alexa:
US rank:  328,966
Global rank:  897,158
Backlinks:  14

Statistics are for the previous month (Alexa statistics are for entire download-nation.com).

Remove Malware from files.download-nation.com - Powered by Reason Core Security