home

i.get-soft-free.net

Domain Information

Server location:
Virginia, United States (US)

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
get-soft-free.net

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Nextup.O, PUP.Nextup.T, PUP.Nextup.N
100.00%

avast!
Win32:Rootkit-gen [Rtk], Win32:Dropper-gen [Drp], Win32:Malware-gen
100.00%

VIPRE Antivirus
Threat.4786530, Rocketfuel Installer
100.00%

Sophos
NextUp
100.00%

G Data
Win32.Application.Nextup
100.00%

Baidu Antivirus
Trojan.Win32.Verti, PUA.Win32.Verti
100.00%

AVG
Generic
100.00%

McAfee
Artemis!CE8DA1A63129, Artemis!5604D42BE6B0, Artemis!C77BDFC47D9D
100.00%

Trend Micro House Call
Suspicious_GEN.F47V0718, Suspicious_GEN.F47V0717, Suspicious_GEN.F47V0906
100.00%

SUPERAntiSpyware
Trojan.Agent/Gen-Verti
80.00%

IKARUS anti.virus
PUA.Verti
80.00%

Malwarebytes
PUP.Optional.Bundle
80.00%

K7 AntiVirus
Trojan
80.00%

Dr.Web
Adware.Downware.6396
60.00%

Qihoo 360 Security
Win32/Trojan.Dropper.c9f
60.00%

The domain i.get-soft-free.net has been seen to resolve to the following 39 IP addresses.

52.84.125.123
server-52-84-125-123.iad16.r.cloudfront.net
July 20, 2016

52.84.125.89
server-52-84-125-89.iad16.r.cloudfront.net
July 20, 2016

52.84.125.71
server-52-84-125-71.iad16.r.cloudfront.net
July 20, 2016

52.84.125.61
server-52-84-125-61.iad16.r.cloudfront.net
July 20, 2016

52.84.125.38
server-52-84-125-38.iad16.r.cloudfront.net
July 20, 2016

52.84.125.32
server-52-84-125-32.iad16.r.cloudfront.net
July 20, 2016

52.84.125.232
server-52-84-125-232.iad16.r.cloudfront.net
July 20, 2016

52.84.125.230
server-52-84-125-230.iad16.r.cloudfront.net
July 20, 2016

54.230.55.223
server-54-230-55-223.jfk6.r.cloudfront.net
May 3, 2015

54.230.53.82
server-54-230-53-82.jfk6.r.cloudfront.net
May 3, 2015

54.192.55.161
server-54-192-55-161.jfk6.r.cloudfront.net
May 3, 2015

54.192.54.173
server-54-192-54-173.jfk6.r.cloudfront.net
May 3, 2015

54.230.52.91
server-54-230-52-91.jfk6.r.cloudfront.net
May 3, 2015

54.192.54.195
server-54-192-54-195.jfk6.r.cloudfront.net
May 3, 2015

54.192.54.193
server-54-192-54-193.jfk6.r.cloudfront.net
May 3, 2015

54.192.54.198
server-54-192-54-198.jfk6.r.cloudfront.net
May 3, 2015

54.192.101.90
server-54-192-101-90.iad2.r.cloudfront.net
December 2, 2014

54.192.101.85
server-54-192-101-85.iad2.r.cloudfront.net
December 2, 2014

54.230.103.20
server-54-230-103-20.iad2.r.cloudfront.net
December 2, 2014

54.230.100.6
server-54-230-100-6.iad2.r.cloudfront.net
December 2, 2014

54.192.101.106
server-54-192-101-106.iad2.r.cloudfront.net
December 2, 2014

54.192.101.102
server-54-192-101-102.iad2.r.cloudfront.net
December 2, 2014

54.192.101.98
server-54-192-101-98.iad2.r.cloudfront.net
December 2, 2014

216.137.33.235
server-216-137-33-235.iad2.r.cloudfront.net
August 17, 2014

216.137.33.120
server-216-137-33-120.iad2.r.cloudfront.net
August 17, 2014

216.137.33.105
server-216-137-33-105.iad2.r.cloudfront.net
August 17, 2014

54.230.103.191
server-54-230-103-191.iad2.r.cloudfront.net
August 17, 2014

54.230.103.167
server-54-230-103-167.iad2.r.cloudfront.net
August 17, 2014

54.230.103.103
server-54-230-103-103.iad2.r.cloudfront.net
August 17, 2014

54.230.101.159
server-54-230-101-159.iad2.r.cloudfront.net
August 17, 2014

 
Showing 30 of 39 IP Addresses

File downloads found at URLs served by i.get-soft-free.net.

17 / 68    (Adware)
http://i.get-soft-free.net/stub/NEXTUP/.../PDFCreatorInstaller.exe  (45ed39f5425786c6f78836e33690d391)

18 / 68    (Adware)
http://i.get-soft-free.net/stub/NEXTUP/.../GimpInstaller.exe  (866badf8071080c111359702d6a75358)

10 / 68    (Adware)
http://i.get-soft-free.net/stub/NEXTUP/.../GimpInstaller.exe  (c77bdfc47d9d4f6dd5ce2b1cb78bb28a)

21 / 68    (Adware)
http://i.get-soft-free.net/stub/NEXTUP/.../GoodgameEmpire.exe  (958d21a530ce9d99e09018dd346dc978)

14 / 68    (Adware)
http://i.get-soft-free.net/stub/NEXTUP/.../GoodgameEmpire.exe  (2266e8f8be65b0da0e6d356d756f097b)

The following 74 files have been seen to comunicate with i.get-soft-free.net in live environments.

TCP » 52.84.125.61:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.84.125.71:80
new_chrome.exe (1stBrowser by The 1stBrowser Authors)

TCP » 54.230.51.72:80
saber.exe

TCP » 52.84.125.89:443
UCBrowser.exe (by UCWeb)

TCP » 54.230.51.72:80
safwaf.exe

TCP » 52.84.125.61:443
online-guardian-v2.0.9.exe

TCP » 54.192.55.161:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 54.230.51.72:80
saber.exe

TCP » 54.192.55.161:80
citrio.exe (Citrio by CatalinaGroup)

TCP » 54.192.55.161:80
browser.exe (speed browser by Smart Applications)

TCP » 54.230.51.169:443
online-guardian-v2.0.9.exe

TCP » 54.192.55.161:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 54.230.51.169:443
beamrise.exe (Beamrise by The Beamrise Authors)

TCP » 54.230.51.72:80
yacqq.exe

TCP » 52.84.125.38:443
ManyCam.exe (ManyCam Virtual Webcam by Visicom Media)

TCP » 52.84.125.89:80
Trezaa.Service.exe (Trezaa.Service by Microsoft)

TCP » 52.84.125.89:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 54.192.55.161:80
QQBrowser.exe (by Tencent)

TCP » 54.230.51.72:80
ipcdl.exe (YAC Security Protection by Elex do Brasil Participaçõesa)

TCP » 54.230.51.72:80
Trezaa.Service.exe (Trezaa.Service by Microsoft)

 
Latest 20 of 103 files

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.