home

free-un.com

Privacy Protection Service INC d/b/a PrivacyProtect.org  (Proxy Registrant)

Domain Information

The domain free-un.com is registered by proxy through PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM and was originally registered in February of 2015. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Ashburn, Virginia within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform.
Registrar:
PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM

Server location:
Virginia, United States (US)

Create date:
Saturday, February 14, 2015

Expires date:
Tuesday, February 14, 2017

Updated date:
Wednesday, February 10, 2016

ASN:
AS14618 AMAZON-AES - Amazon.com, Inc.,US

Whois:
2 free-un.com records

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.InstallCore.Internet.Installer.Meta (M), PUP.NewMedia.Installer.installCore.Installer (M), PUP.InstallCore.RES (M), PUP.NewMedia.NMH (M)
85.71%

ESET NOD32
Win32/InstallCore.WT potentially unwanted application
14.29%

VIPRE Antivirus
Threat.4788237
14.29%

G Data
Win32.Application.InstallCore.CZ
14.29%

The domain free-un.com has been seen to resolve to the following 6 IP addresses.

52.7.132.182
ec2-52-7-132-182.compute-1.amazonaws.com
April 4, 2016

107.23.203.23
ec2-107-23-203-23.compute-1.amazonaws.com
April 4, 2016

54.84.143.69
ec2-54-84-143-69.compute-1.amazonaws.com
April 4, 2016

54.236.147.238
ec2-54-236-147-238.compute-1.amazonaws.com
June 19, 2015

54.209.232.94
ec2-54-209-232-94.compute-1.amazonaws.com
June 19, 2015

54.84.140.114
ec2-54-84-140-114.compute-1.amazonaws.com
June 19, 2015

File downloads found at URLs served by free-un.com.

1 / 68      (Adware)
http://free-un.com/?dl=1&dr=cHaWck1mIXvlDmW4vExthXN3DKV0AQDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWVVAm7dREhKVuvmAWASDChTMm7dlChV8dNTnwAzgwOTnm7K2pDZ1fNzM3OTayOZn0Ag==&pd=2323UmFl2y1QDXN07XswUmNJ i==&campaignId=9jn0AjAFAzAyAZMq  (firefoxsetup.exe)

1 / 68      (Adware)
http://free-un.com/?dl=1&dr=cHaWck1w 3sj 3vuUXxp KLm2r0Wc32lDXimc3aW7mcmIT1zvm2yIKiWvmREhKVuvmNjhVVTvmNBDz1l QDjhTnmDZ0wvmNpDZ1fOTgdAzcyATiRvm5EIKiWXznyAZLzATL0OZa=&pd=2323UmDyDKVJ mRp mV37XxjIkFj d0=&campaignId=9jn0AjiRAjC0AZMq  (popcorn timesetup.exe)

1 / 68      (PUP)
http://free-un.com/?dl=1&dr=cHaWck1P m2yeS1QIXvCcyD0 T1z2dVl2kDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWxVAm7dREhKVuvmAWASDChTMm7dlChV81AT71AZARNZnm7K2pDZ1fOZAzAjgyATnwAw==&pd=2323UmPlcmLtDEvlDSFj d0=&campaignId=9jn0AjAFOTgwAZMq  (angrybirdssetup.exe)

1 / 68      (Adware)
http://free-un.com/?dl=1&dr=c3aW7mcm2r0Wc32lDXimcHaWck1E dWE rLtDK5y2rgmIT1zvm2yIKiWvmREhKVzvmNjhLVTvmNBDz1lcyDjhTnmDZ0wvmNpDZ1fAzizNzMyATiRvm5EIKiWXzCyNz71NZczOZa=&pd=2323UmNJ Xs12rVyUK5wcHAu7dWt&campaignId=9jn0Aji4OZL0AZMq  (googleearthsetup.exe)

1 / 68      (Adware)
http://free-un.com/?dl=1&dr=cHaWck1mIXvlDmW4vExthXN3DKV0AQDzcj1QDyDphXAmD3vpDZ0m rcWDEam7dAWxlam7dREhKDyvmAWASDChTMm7dlChV8yNTnwAzgwOTnm7K2pDZ1fNTg1OZayOZn0Ag==&pd=2323UmFl2y1QDXN07XswUmNJ i==&campaignId=9jn0AjiwATa0AZMq  (firefoxsetup.exe)

1 / 68      (PUP)
http://free-un.com/?dl=1&dr=cHaWck1zcrW0IKDFvExthXN3DKV0vENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1VLyDj rcWDK4m7z0RvmiWAkDjIKiWXzAFNzM1Ajn0ASDPDdlChV8ROZMROZCRNZgy&pd=2323Um53DXNJ KVw7d5wcHAu7dWt&campaignId=9jn0AjiyOTgdAZMq  (spotifysetup.exe)

3 / 68      (PUP)
http://free-un.com/?dl=1&dr=cHaWck10DK5t2mll2dVyvExthXN3DKV0AQDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWxlam7dREhKVuvmAWASDChTMm7dlChV8ROZgzOTARNZnm7K2pDZ1fOZn4OZcdNjnwAw==&pd=2323Um5Q7y1mcmVlUmNJ i==&campaignId=9jn0AjAFAZi0AZMq  (teamviewer_setup.exe)

The following 3 files have been seen to comunicate with free-un.com in live environments.

TCP » 54.84.143.69:80
WajamInternetEnhancer.exe (Wajam Internet Enhancer by Wajam Internet Technologies)

TCP » 54.84.143.69:80
notifier64.exe (Notifications)

TCP » 54.84.143.69:80
ContentFinder.exe (ContentFinder by ContentFinder Company)

URL:
http://free-un.com/

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
nginx/1.4.7

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.