home

glksoft.com

PERFECT PRIVACY, LLC  (Proxy Registrant)

Domain Information

The domain glksoft.com is registered by proxy through DOMAINSURGEON.COM LLC and was originally registered in September of 2015. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Scottsdale, Arizona within the United States which resides on the GoDaddy.com, LLC network.
Registrar:
DOMAINSURGEON.COM LLC

Server location:
Arizona, United States (US)

Create date:
Friday, September 11, 2015

Expires date:
Sunday, September 11, 2016

Updated date:
Friday, September 11, 2015

ASN:
AS26496 AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC

Whois:
3 glksoft.com records

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Installer.InformationTechnologySystems.R, PUP.Installer.InformationTechnologySystemsdoo.R, Threat.Installer.InformationTechnologySystemsdoo, PUP.installCore.InformationTechnologySystemsdoo.Installer (M), PUP.installCore.OOOAlians.Installer (M), PUP.Coinis.installCore.Installer (M), PUP.InstallCore.Installer.Meta (M), PUP.Coinis (M)
100.00%

Malwarebytes
PUP.Optional.Downloader, PUP.Optional.InfoTech
50.00%

K7 AntiVirus
Trojan , Unwanted-Program
50.00%

AVG
Generic
50.00%

McAfee
Trojan.Artemis!460ECEB35134, Trojan.Artemis!37216996A8AB
50.00%

Dr.Web
Trojan.Packed.28409, Adware.Downware.6398, Trojan.Packed.28587
42.86%

Avira AntiVirus
ADWARE/InstallCore.Gen9
42.86%

ESET NOD32
Win32/InstallCore.PX potentially unwanted application, Win32/InstallCore.PZ potentially unwanted application
42.86%

SUPERAntiSpyware
PUP.InstallCore/Variant
42.86%

VIPRE Antivirus
Threat.4150696
42.86%

Kaspersky
not-a-virus:AdWare.Win32.InstallCore
42.86%

F-Prot
W32/InstallCore.AC.gen
35.71%

Sophos
Install Core Click run software, PUA 'Install Core Click run software'
35.71%

Zillya! Antivirus
Adware.InstallCore.Win32.183
28.57%

NANO AntiVirus
Riskware.Text.Drop.deckwp
28.57%

The domain glksoft.com has been seen to resolve to the following 7 IP addresses.

204.11.56.37
September 15, 2016

185.53.178.12
July 18, 2016

52.18.157.175
ec2-52-18-157-175.eu-west-1.compute.amazonaws.com
May 19, 2016

185.53.178.9
January 4, 2016

185.53.178.8
December 26, 2015

184.168.221.49
ip-184-168-221-49.ip.secureserver.net
February 20, 2015

207.244.85.69
August 17, 2014

File downloads found at URLs served by glksoft.com.

1 / 68      (Adware)
http://glksoft.com/.../download.php?site_id=188&app_id=4&lp_id=106&v=&dist_id=125&channel=acpopf100&src=ac&cid=u6c40e58152cba2e79115012d6e&pubid=231699  (adobe_flash_setup.exe)

1 / 68      (Adware)
http://glksoft.com/.../download.php?site_id=188&app_id=4&lp_id=256&dist_id=125&channel=acpopf100&src=ac&cid=16119475681406178805&pubid=241044  (adobe_flash_setup.exe)

1 / 68      (Adware)
http://glksoft.com/.../download.php?site_id=188&app_id=4&lp_id=252&v=&dist_id=125&channel=acpopf100&src=ac&cid=4061184161406333793&pubid=160076  (adobe_flash_setup.exe)

1 / 68      (Adware)
http://glksoft.com/.../download.php?site_id=188&app_id=4&lp_id=220&dist_id=125&channel=acpopf100&src=ac&cid=4113419101406060508&pubid=208447  (adobe_flash_setup.exe)

1 / 68      (PUP)
http://glksoft.com/.../download.php?site_id=188&app_id=4&lp_id=257&v=&dist_id=125&channel=acpopf100&src=ac&cid=29270116341406408771&pubid=162609  (adobe_flash_setup.exe)

1 / 68      (Adware)
http://glksoft.com/.../download.php?site_id=188&app_id=4&lp_id=252&dist_id=125&channel=acpopf100&src=ac&cid=15342943731406203663&pubid=151018  (adobe_flash_setup.exe)

1 / 68      (Adware)
http://glksoft.com/.../download.php?site_id=188&app_id=4&lp_id=250&dist_id=125&channel=acpopf100&src=ac&cid=12231489971406253170&pubid=231699  (adobe_flash_setup.exe)

1 / 68      (Adware)
http://glksoft.com/.../download.php?site_id=188&app_id=4&lp_id=255&v=&dist_id=125&channel=acpopf100&src=ac&cid=23099971591406446666&pubid=160592  (adobe_flash_setup.exe)

20 / 68    (Adware)
http://glksoft.com/.../download.php?site_id=188&app_id=4&lp_id=106&v=&dist_id=125&channel=acpopf100&src=ac&cid=8553121291406342128&pubid=231699  (adobe_flash_setup.exe)

20 / 68    (Adware)
http://glksoft.com/.../download.php?site_id=188&app_id=4&lp_id=106&v=&dist_id=125&channel=acpopf100&src=ac&cid=12671446101406342559&pubid=231699  (adobe_flash_setup.exe)

17 / 68    (Adware)
http://glksoft.com/.../download.php?site_id=188&app_id=4&lp_id=257&v=&dist_id=125&channel=acpopf100&src=ac&cid=11130168041406422401&pubid=36910  (adobe_flash_setup.exe)

16 / 68    (Adware)
http://glksoft.com/.../download.php?site_id=188&app_id=4&lp_id=253&v=&dist_id=125&channel=acpopf100&src=ac&cid=406665791406491633&pubid=114010  (adobe_flash_setup.exe)

18 / 68    (Adware)
http://glksoft.com/.../download.php?site_id=188&app_id=4&lp_id=252&v=&dist_id=125&channel=acpopf100&src=ac&cid=11173628301406478621&pubid=292394  (adobe_flash_setup.exe)

12 / 68    (Adware)
http://glksoft.com/.../download.php?site_id=188&app_id=4&lp_id=252&v=&dist_id=125&channel=acpopf100&src=ac&cid=11173628301406478621&pubid=292394  (adobe_flash_setup.exe)

The following 24 files have been seen to comunicate with glksoft.com in live environments.

TCP » 184.168.221.49:80
jingling.exe

TCP » 184.168.221.49:80
apptrailers.exe

TCP » 184.168.221.49:80
online-guardian-v2.0.9.exe

TCP » 52.18.157.175:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 184.168.221.49:80
onlineguardian-v2.exe

TCP » 184.168.221.49:25
www.exe

TCP » 184.168.221.49:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 184.168.221.49:443
036629fbd4864725737a8ba8fe7e8cd6.exe

TCP » 184.168.221.49:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 184.168.221.49:80
online-guardian-v2.exe

TCP » 184.168.221.49:443
veribrowserr170.exe

TCP » 184.168.221.49:80
ContentFinder.exe (ContentFinder by ContentFinder Software)

TCP » 184.168.221.49:443
zdengine.exe (zdengine.exe by zdengine)

TCP » 184.168.221.49:443
d3992a7f4aa81f1f72e5672c89dbed75.exe

TCP » 184.168.221.49:80
ContentSinder.exe (ContentSinder by ContentSinder Company)

TCP » 184.168.221.49:80
bfa0d68f.exe (Client Server Runtime Process by Microsoft)

TCP » 184.168.221.49:25
wrk.exe

TCP » 184.168.221.49:443
2efc0fa24a9513847cfac6d94441f0fa.exe

TCP » 184.168.221.49:443
zdengine.exe (zdengine.exe by zdengine)

TCP » 52.18.157.175:80
UCBrowser.exe (by UCWeb)

 
Latest 20 of 60 files

URL:
http://glksoft.com/

Title:
“glksoft.com”

Web server:
nginx

Facebook:
Shares:  7

Statistics above are for the previous month of March 2024.

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.