home

i.getswfree.com

Domain Information

Server location:
Virginia, United States (US)

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
getswfree.com

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

VIPRE Antivirus
Rocketfuel Installer, Trojan.Win32.Generic
100.00%

Trend Micro House Call
Suspicious_GEN.F47V1204, Suspicious_GEN.F47V1203, Suspicious_GEN.F47V1226
100.00%

ESET NOD32
Win32/Verti (variant)
100.00%

AVG
Wecan
100.00%

Baidu Antivirus
PUA.Win32.Verti
100.00%

Reason Heuristics
PUP.WecanSoftware.BB
100.00%

Malwarebytes
PUP.Optional.WeCan.A
100.00%

SUPERAntiSpyware
Adware.Rocketful/Variant
100.00%

K7 AntiVirus
Trojan
100.00%

Sophos
Generic PUA GD, NextUp
100.00%

McAfee
Artemis!A099AF31B982, Artemis!D511D21295EE
100.00%

MicroWorld eScan
Trojan.Generic.12417497
33.33%

nProtect
Trojan.Generic.12417497
33.33%

NANO AntiVirus
Riskware.Win32.Downware.dlauux
33.33%

Kaspersky
not-a-virus:AdWare.Win32.Verti
33.33%

The domain i.getswfree.com has been seen to resolve to the following 16 IP addresses.

52.84.125.217
server-52-84-125-217.iad16.r.cloudfront.net
May 25, 2016

52.84.125.162
server-52-84-125-162.iad16.r.cloudfront.net
May 25, 2016

52.84.125.135
server-52-84-125-135.iad16.r.cloudfront.net
May 25, 2016

52.84.125.96
server-52-84-125-96.iad16.r.cloudfront.net
May 25, 2016

52.84.125.85
server-52-84-125-85.iad16.r.cloudfront.net
May 25, 2016

52.84.125.51
server-52-84-125-51.iad16.r.cloudfront.net
May 25, 2016

52.84.125.234
server-52-84-125-234.iad16.r.cloudfront.net
May 25, 2016

52.84.125.232
server-52-84-125-232.iad16.r.cloudfront.net
May 25, 2016

54.192.54.193
server-54-192-54-193.jfk6.r.cloudfront.net
May 3, 2015

54.192.55.161
server-54-192-55-161.jfk6.r.cloudfront.net
May 3, 2015

54.192.54.198
server-54-192-54-198.jfk6.r.cloudfront.net
May 3, 2015

54.192.54.173
server-54-192-54-173.jfk6.r.cloudfront.net
May 3, 2015

54.192.54.195
server-54-192-54-195.jfk6.r.cloudfront.net
May 3, 2015

54.230.55.223
server-54-230-55-223.jfk6.r.cloudfront.net
May 3, 2015

54.230.53.82
server-54-230-53-82.jfk6.r.cloudfront.net
May 3, 2015

54.230.52.91
server-54-230-52-91.jfk6.r.cloudfront.net
May 3, 2015

File downloads found at URLs served by i.getswfree.com.

28 / 68    (Adware)
http://i.getswfree.com/stub/WECAN/.../MediaPlayerClassicInstaller.exe  (d511d21295ee9d64adcd3b4ebcf11aa7)

11 / 68    (Adware)
http://i.getswfree.com/stub/WECAN/.../MediaPlayerClassicInstaller.exe  (63afcc6ab1c3650e648ce1fc02b96c42)

11 / 68    (Adware)
http://i.getswfree.com/stub/WECAN/.../MediaPlayerClassicInstaller.exe  (a099af31b982e02311ef74658701acaf)

The following 49 files have been seen to comunicate with i.getswfree.com in live environments.

TCP » 52.84.125.162:80
browser.exe (speed browser by Smart Applications)

TCP » 52.84.125.85:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.84.125.234:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 54.192.55.161:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.84.125.96:80
clearscreenplayerbrowser.exe

TCP » 54.192.55.161:80
citrio.exe (Citrio by CatalinaGroup)

TCP » 54.192.55.161:80
browser.exe (speed browser by Smart Applications)

TCP » 54.192.55.161:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.84.125.162:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.84.125.234:443
online-guardian-v2.0.9.exe

TCP » 52.84.125.234:443
browser.exe (Speed Browser by Long Mile Solutions)

TCP » 54.192.55.161:80
QQBrowser.exe (by Tencent)

TCP » 52.84.125.232:443
Client.exe

TCP » 52.84.125.232:80
Mobogenie.exe (Mobogenie by Mobogenie.com)

TCP » 52.84.125.85:80
browser.exe (Speed Browser by Smart Applications)

TCP » 52.84.125.85:80
Client.exe

TCP » 52.84.125.85:80
Mobogenie.exe (Mobogenie by Mobogenie.com)

TCP » 54.192.55.161:80
task.exe

TCP » 54.192.55.161:80
BrowserSafer.exe (BrowserSafer by Installer Technology Co)

TCP » 52.84.125.162:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

 
Latest 20 of 77 files

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.