home

i.getswfree.net

Domain Information

Server location:
Washington, United States (US)

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
getswfree.net

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.WecanSoftware.BB, PUP.Bundler.Verti, PUP.Verti.UsefulSo.Bundler (M)
100.00%

Malwarebytes
PUP.Optional.WeCan.A, PUP.Optional.Useful
66.67%

VIPRE Antivirus
Trojan.Win32.Generic, Rocketfuel Installer
66.67%

K7 AntiVirus
Trojan , Unwanted-Program
66.67%

NANO AntiVirus
Riskware.Win32.Downware.dlauux
66.67%

Sophos
NextUp
66.67%

Comodo Security
Application.Win32.Verti.JBT
66.67%

Avira AntiVirus
APPL/Verti.269648, ADWARE/Adware.Gen7
66.67%

McAfee
Artemis!3D122D0EB731, Artemis!2813152031F9
66.67%

Vba32 AntiVirus
Downloader.Agent, AdWare.Verti
66.67%

ESET NOD32
Win32/Verti (variant), Win32/Verti.J potentially unwanted (variant)
66.67%

IKARUS anti.virus
PUA.Verti
66.67%

Fortinet FortiGate
Adware/Verti, Riskware/Verti
66.67%

AVG
Wecan, Generic
66.67%

Qihoo 360 Security
HEUR/QVM18.1.Malware.Gen, HEUR/QVM11.1.Malware.Gen
66.67%

The domain i.getswfree.net has been seen to resolve to the following 19 IP addresses.

52.85.131.252
server-52-85-131-252.iad53.r.cloudfront.net
August 9, 2016

52.85.131.228
server-52-85-131-228.iad53.r.cloudfront.net
August 9, 2016

52.85.131.212
server-52-85-131-212.iad53.r.cloudfront.net
August 9, 2016

52.85.131.110
server-52-85-131-110.iad53.r.cloudfront.net
August 9, 2016

52.85.131.99
server-52-85-131-99.iad53.r.cloudfront.net
August 9, 2016

52.85.131.65
server-52-85-131-65.iad53.r.cloudfront.net
August 9, 2016

52.85.131.32
server-52-85-131-32.iad53.r.cloudfront.net
August 9, 2016

52.85.131.10
server-52-85-131-10.iad53.r.cloudfront.net
August 9, 2016

54.230.36.115
server-54-230-36-115.jfk1.r.cloudfront.net
May 4, 2015

54.192.36.76
server-54-192-36-76.jfk1.r.cloudfront.net
May 4, 2015

54.230.39.194
server-54-230-39-194.jfk1.r.cloudfront.net
May 4, 2015

54.230.36.56
server-54-230-36-56.jfk1.r.cloudfront.net
May 4, 2015

54.230.39.52
server-54-230-39-52.jfk1.r.cloudfront.net
May 4, 2015

54.230.36.204
server-54-230-36-204.jfk1.r.cloudfront.net
May 4, 2015

54.230.38.222
server-54-230-38-222.jfk1.r.cloudfront.net
May 4, 2015

54.230.38.177
server-54-230-38-177.jfk1.r.cloudfront.net
May 4, 2015

54.230.103.248
server-54-230-103-248.iad2.r.cloudfront.net
March 23, 2015

54.230.101.114
server-54-230-101-114.iad2.r.cloudfront.net
March 23, 2015

54.230.101.54
server-54-230-101-54.iad2.r.cloudfront.net
March 23, 2015

File downloads found at URLs served by i.getswfree.net.

1 / 68      (Adware)
http://i.getswfree.net/stub/UINST/.../MediaPlayerClassic.exe  (a03dfe944bb38eaf4d26a06f34619bcb)

26 / 68    (Adware)
http://i.getswfree.net/stub/WECAN/.../MediaPlayerClassicInstaller.exe  (3d122d0eb731a718a1ee05a1a4c5600a)

18 / 68    (Adware)
http://i.getswfree.net/stub/UINST/.../MediaPlayerClassic.exe  (2813152031f9ee841d4d8e8dab978615)

The following 35 files have been seen to comunicate with i.getswfree.net in live environments.

TCP » 54.192.36.76:80
winsaber.exe

TCP » 52.85.131.252:443
browser.exe (Browser)

TCP » 54.192.36.76:80
saber.exe

TCP » 52.85.131.252:80
browser.exe (Browser)

TCP » 52.85.131.10:443
browser.exe (Browser)

TCP » 54.192.36.76:80
saber.exe

TCP » 54.192.36.76:80
instatime.exe

TCP » 54.192.36.76:80
winsaber.exe

TCP » 54.192.36.76:80
safwaf.exe

TCP » 54.192.36.76:80
winsaber.exe

TCP » 54.192.36.76:80
winsaber.exe

TCP » 54.192.36.76:80
dahashhecechreportszlt.exe

TCP » 52.85.131.32:443
online-guardian-v2.0.9.exe

TCP » 54.192.36.76:80
nsxe920.tmp

TCP » 54.192.36.76:80
nsad5.tmp

TCP » 54.192.36.76:80
nsh38fa.tmp

TCP » 54.192.36.76:80
nshf430.tmp

TCP » 54.192.36.76:80
nsf5746.tmp

TCP » 54.192.36.76:80
nsgd519.tmp

TCP » 54.192.36.76:80
nsz8534.tmp

 
Latest 20 of 56 files

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.