home

soft.foxtab.com

Domains By Proxy, LLC  (Proxy Registrant)

Domain Information

The domain soft.foxtab.com is registered by proxy through GODADDY.COM, LLC and was originally registered in September of 2008. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Belfast, Northern Ireland within United Kingdom which resides on the RIPE Network Coordination Centre network.
Registrar:
GODADDY.COM, LLC

Server location:
Northern Ireland, United Kingdom (GB)

Create date:
Saturday, September 6, 2008

Expires date:
Friday, September 6, 2019

Updated date:
Sunday, June 10, 2012

Root domain:
foxtab.com

Whois:
1 foxtab.com record

Scanner detections:
Detections  (82% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.installCore.Clickrun.Installer (M), PUP.installCore (M), PUP.ironSource (M), PUP.InstallCore.ENG (M), Threat.Win.Reputation.IMP, PUP.installCore.Installer (M)
95.35%

F-Prot
W32/InstallCore.I.gen, W32/InstallCore.F_2.gen, W32/InstallCore.B.gen, W32/InstallCore.N.gen, W32/InstallCore.C.gen
20.93%

ESET NOD32
Win32/InstallCore.AX potentially unwanted application, Win32/InstallCore.O potentially unwanted application, Win32/InstallCore.BH potentially unwanted application
18.60%

AVG
Adware InstallCore.EM, Generic28, Adware InstallCore.CC, Adware InstallCore.MN
9.30%

VIPRE Antivirus
Trojan.Win32.Generic, Click run software
6.98%

ESET NOD32
Win32/InstallCore.BH (variant), Win32/Kryptik.HAZ (variant), Win32/InstallCore.BB (variant)
6.98%

MicroWorld eScan
Gen:Variant.Adware.Graftor.60320, Gen:Variant.Adware.Graftor.46782
4.65%

McAfee
Generic PUP.x!cb3, Artemis!BF3FAC4FB11F
4.65%

Malwarebytes
Adware.Agent
4.65%

K7 AntiVirus
Unwanted-Program, Unwanted-Program
4.65%

NANO AntiVirus
Trojan.Win32.Downware.bdcthy, Trojan.Win32.InstallCore.smpra
4.65%

Trend Micro House Call
TROJ_GEN.USBH31ACN, TROJ_SPNR.0BHH14
4.65%

avast!
Win32:InstallCore-GF [PUP], Win32:InstallCore-HF [PUP]
4.65%

Bitdefender
Gen:Variant.Adware.Graftor.60320, Gen:Variant.Adware.Graftor.46782
4.65%

Sophos
Install Core, Install Core (PUA)
4.65%

The domain soft.foxtab.com has been seen to resolve to the following 36 IP addresses.

92.242.140.21
unallocated.barefruit.co.uk
March 6, 2015

23.23.147.163
ec2-23-23-147-163.compute-1.amazonaws.com
November 18, 2014

23.21.248.197
ec2-23-21-248-197.compute-1.amazonaws.com
November 18, 2014

54.204.24.74
ec2-54-204-24-74.compute-1.amazonaws.com
November 18, 2014

184.73.204.170
ec2-184-73-204-170.compute-1.amazonaws.com
November 1, 2014

54.225.134.83
ec2-54-225-134-83.compute-1.amazonaws.com
October 24, 2014

23.21.90.221
ec2-23-21-90-221.compute-1.amazonaws.com
October 24, 2014

54.243.157.254
ec2-54-243-157-254.compute-1.amazonaws.com
October 24, 2014

54.197.226.15
ec2-54-197-226-15.compute-1.amazonaws.com
October 9, 2014

107.22.254.118
ec2-107-22-254-118.compute-1.amazonaws.com
October 9, 2014

54.243.118.170
ec2-54-243-118-170.compute-1.amazonaws.com
October 9, 2014

54.221.250.180
ec2-54-221-250-180.compute-1.amazonaws.com
September 27, 2014

184.73.226.241
ec2-184-73-226-241.compute-1.amazonaws.com
September 27, 2014

54.235.86.131
ec2-54-235-86-131.compute-1.amazonaws.com
September 27, 2014

54.243.147.166
ec2-54-243-147-166.compute-1.amazonaws.com
September 18, 2014

50.17.181.169
ec2-50-17-181-169.compute-1.amazonaws.com
September 18, 2014

23.23.120.113
ec2-23-23-120-113.compute-1.amazonaws.com
September 18, 2014

54.204.10.246
ec2-54-204-10-246.compute-1.amazonaws.com
September 15, 2014

23.21.88.249
ec2-23-21-88-249.compute-1.amazonaws.com
September 15, 2014

54.243.142.86
ec2-54-243-142-86.compute-1.amazonaws.com
September 15, 2014

23.23.237.76
ec2-23-23-237-76.compute-1.amazonaws.com
September 2, 2014

54.243.173.44
ec2-54-243-173-44.compute-1.amazonaws.com
September 2, 2014

50.16.222.107
ec2-50-16-222-107.compute-1.amazonaws.com
September 2, 2014

50.19.246.5
ec2-50-19-246-5.compute-1.amazonaws.com
August 12, 2014

107.22.192.154
ec2-107-22-192-154.compute-1.amazonaws.com
August 12, 2014

107.20.206.43
ec2-107-20-206-43.compute-1.amazonaws.com
August 12, 2014

50.19.110.175
ec2-50-19-110-175.compute-1.amazonaws.com
August 7, 2014

23.23.217.107
ec2-23-23-217-107.compute-1.amazonaws.com
August 7, 2014

23.23.188.8
ec2-23-23-188-8.compute-1.amazonaws.com
August 7, 2014

107.22.217.18
ec2-107-22-217-18.compute-1.amazonaws.com
June 20, 2014

 
Showing 30 of 36 IP Addresses

File downloads found at URLs served by soft.foxtab.com.

1 / 68      (inconclusive)
http://soft.foxtab.com/media-player/gc/.../?dl=1  (mediaplayersetup.exe)

1 / 68      (Adware)
http://soft.foxtab.com/pdf-creator/gb/.../?dl=1  (pdfcreatorsetup.exe)

1 / 68      (Adware)
http://soft.foxtab.com/pdf-creator/gb/.../?dl=1  (pdfcreatorsetup.exe)

0 / 68
http://soft.foxtab.com/pdf-reader/gb/.../?dl=1  (pdfreadersetup.exe)

1 / 68      (PUP)
http://soft.foxtab.com/video-converter/gd/.../?dl=1  (videoconvertersetup.exe)

0 / 68
http://soft.foxtab.com/pdf-reader/gb/.../?dl=1  (pdfreadersetup.exe)

1 / 68      (Malware)
http://soft.foxtab.com/pdf-reader/gb/.../?dl=1  (pdfreadersetup_v3.exe)

1 / 68      (PUP)
http://soft.foxtab.com/pdf-reader/gb/.../?dl=1&test=2&tschnl=PDR1_SK_H&adnm=24755363996&i=s&grid=A&lg=EN&cc=MX&clg=en&c=1&d=1&cid=_697130801&kw=&mn=www.quedelibros.com&Network=D&expr=&agid=_6150990104  (pdfreadersetup.exe)

1 / 68      (PUP)
http://soft.foxtab.com/flv-player/gc/.../?dl=1  (flvplayersetup.exe)

0 / 68
http://soft.foxtab.com/pdf-reader?adnm=14027405156&lg=EN&cc=PL&c=1&d=1&cid=_619130801&kw=&mn=www.programosy.pl&Network=D&expr=&agid=_6113001104&pr=pdf-reader&sr=gb&lp=sh&dl=1  (pdfreadersetup.exe)

1 / 68      (PUP)
http://soft.foxtab.com/pdf-converter/gb/.../?dl=1  (pdfconvertersetup.exe)

1 / 68      (Adware)
http://soft.foxtab.com/video-converter/gd/.../?dl=1  (videoconvertersetup.exe)

1 / 68      (PUP)
http://soft.foxtab.com/pdf-reader/gb/.../?dl=1&test=1&tschnl=PDR1_SJ_H&adnm=24755298236&i=s&grid=A&lg=EN&cc=AR&clg=en&c=1&d=1&cid=_672230801&kw=&mn=www.publijuegos.com&Network=D&expr=&agid=_6344001104  (pdfreadersetup.exe)

1 / 68      (Adware)
http://soft.foxtab.com/flv-player/gc/.../?dl=1  (flvplayersetup.exe)

1 / 68      (PUP)
http://soft.foxtab.com/music-converter/ga/.../?dl=1  (musicconvertersetup.exe)

3 / 68      (Adware)
http://soft.foxtab.com/media-player/gc/.../?dl=1  (mediaplayersetup.exe)

The following 232 files have been seen to comunicate with soft.foxtab.com in live environments.

TCP » 92.242.140.21:80
smelled.exe (Smelled)

TCP » 92.242.140.21:443
dca-monitoring.exe (Compete DCA Monitoring Tool by Compete)

TCP » 92.242.140.21:80
marini.exe (Marini)

TCP » 23.23.217.107:80
browser.exe (Browser)

TCP » 92.242.140.21:443
client.exe (ClientWrapper)

TCP » 92.242.140.21:80
thebrowser.exe (TheBrowser by Goobzo)

TCP » 92.242.140.21:443
dca-monitoring.exe (Compete DCA Monitoring Tool by Compete)

TCP » 92.242.140.21:443
WindowService.exe (WindowService)

TCP » 92.242.140.21:443
ciuninstall.exe

TCP » 92.242.140.21:1866
jutched.exe

TCP » 92.242.140.21:443
dca-monitoring.exe (Compete DCA Monitoring Tool by Compete)

TCP » 92.242.140.21:80
masterupdater.exe

TCP » 107.22.254.118:80
ikliqo.exe

TCP » 92.242.140.21:80
pricemeterexpress.crx

TCP » 92.242.140.21:80
chrome.crx

TCP » 92.242.140.21:80
app-center.crx

TCP » 92.242.140.21:80
ntp.crx

TCP » 92.242.140.21:80
3dayinvite.crx

TCP » 92.242.140.21:80
twitter.crx

TCP » 92.242.140.21:80
viewlater.crx

 
Latest 20 of 234 files

URL:
http://soft.foxtab.com/

Google Analytics:
UA-5682216

Title:
“Media Player”

Description:
“FoxTab provides a new fascinating and elegant method for finding and selecting a tab in the browser.”

Web server:
nginx/1.0.15

Compete.com:
US visitors:  1,172

Statistics are for the previous month.

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.