home

safedownloaddirect.info

Domain Information

Server location:
Northern Ireland, United Kingdom (GB)

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
Adware.AdInjector.Installer.WebPick, Adware.WebPick.Installer (M)
100.00%

F-Prot
W32/InstallRex.B
50.00%

Emsisoft Anti-Malware
Gen:Variant.Application.Bundler.InstallRex
50.00%

VIPRE Antivirus
Threat.14871
50.00%

avast!
Win32:Downloader-TRK [Adw]
50.00%

ESET NOD32
Win32/InstalleRex.I potentially unwanted application
50.00%

Dr.Web
Adware.Downware.836, Adware.Downware.1252
50.00%

Norman
Trojan.Generic.10010748
50.00%

Lavasoft Ad-Aware
Gen:Variant.Application.Bundler.InstallRex.2
50.00%

Clam AntiVirus
Win.Trojan.10010748
50.00%

Kaspersky
not-a-virus:HEUR:Downloader.Win32.AdLoad
50.00%

Bkav FE
W32.HfsAdware
50.00%

MicroWorld eScan
Gen:Variant.Application.Bundler.InstallRex.2
50.00%

nProtect
Trojan-Clicker/W32.Agent.298840
50.00%

Quick Heal
PUA.Moshekaras.Gen
50.00%

The domain safedownloaddirect.info has been seen to resolve to the following IP address.

92.242.140.21
unallocated.barefruit.co.uk
May 21, 2015

File downloads found at URLs served by safedownloaddirect.info.

1 / 68      (Adware)
http://safedownloaddirect.info/.../?affiliate_id=eb2&product_name=FORM 02 10 Autorizacion para realizar educacion fisica 2010 pdf&installer_file_name=FORM 02 10 Autorizacion para realizar educacion fisica 2010 pdf&r=252  (form 02 10 autorizacion para realizar educacion fisica 2010 pdf.exe)

33 / 68    (Adware)
http://safedownloaddirect.info/.../?product_name=Download Revised Quotations Cover Letter in Word Format doc&installer_file_name=Download Revised Quotations Cover Letter in Word Format doc&r=431  (download revised quotations cover letter in word format doc.exe)

The following 230 files have been seen to comunicate with safedownloaddirect.info in live environments.

TCP » 92.242.140.21:80
smelled.exe (Smelled)

TCP » 92.242.140.21:443
dca-monitoring.exe (Compete DCA Monitoring Tool by Compete)

TCP » 92.242.140.21:80
marini.exe (Marini)

TCP » 92.242.140.21:443
client.exe (ClientWrapper)

TCP » 92.242.140.21:80
thebrowser.exe (TheBrowser by Goobzo)

TCP » 92.242.140.21:443
dca-monitoring.exe (Compete DCA Monitoring Tool by Compete)

TCP » 92.242.140.21:443
WindowService.exe (WindowService)

TCP » 92.242.140.21:443
ciuninstall.exe

TCP » 92.242.140.21:1866
jutched.exe

TCP » 92.242.140.21:443
dca-monitoring.exe (Compete DCA Monitoring Tool by Compete)

TCP » 92.242.140.21:80
masterupdater.exe

TCP » 92.242.140.21:80
pricemeterexpress.crx

TCP » 92.242.140.21:80
chrome.crx

TCP » 92.242.140.21:80
app-center.crx

TCP » 92.242.140.21:80
ntp.crx

TCP » 92.242.140.21:80
3dayinvite.crx

TCP » 92.242.140.21:80
twitter.crx

TCP » 92.242.140.21:80
viewlater.crx

TCP » 92.242.140.21:80
rss.crx

TCP » 92.242.140.21:80
datapump.crx

 
Latest 20 of 230 files

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.