home

software.windownload.net

Domains By Proxy, LLC  (Proxy Registrant)

Domain Information

The domain software.windownload.net is registered by proxy through GODADDY.COM, LLC and was originally registered in February of 2014. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Dublin, Dublin City within Ireland which resides on the RIPE Network Coordination Centre network. The domain uses the Amazon Web Services (AWS) cloud computing platform.
Registrar:
GODADDY.COM, LLC

Server location:
Dublin City, Ireland (IE)

Create date:
Tuesday, February 4, 2014

Expires date:
Wednesday, February 4, 2015

Updated date:
Friday, February 14, 2014

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.

Root domain:
windownload.net

Whois:
2 windownload.net records

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Malwarebytes
PUP.Optional.Downloadster
100.00%

Trend Micro House Call
TROJ_GEN.F47V0217, Suspicious_GEN.F47V1106
100.00%

Sophos
Ez Toolbar Downloader, Generic PUA CH
100.00%

VIPRE Antivirus
InstallCore
100.00%

ESET NOD32
Win32/Toolbar.MyWebSearch (variant)
100.00%

Reason Heuristics
PUP.Installer.QuickDownloader.M
100.00%

herdProtect (fuzzy)
a variant of 8329d1dea8e660bb1cd251c34f7bf729a6e69028, a variant of 1a8e92a3d127340774cfbd54cb26e656519e4bec
100.00%

K7 AntiVirus
Unwanted-Program
100.00%

avast!
Win32:PUP-gen [PUP]
100.00%

AVG
Skodna.Generic, AdPlugin
100.00%

Dr.Web
Adware.Downware.2468
50.00%

McAfee
Artemis!CA9B0CE2C45B
50.00%

Agnitum Outpost
PUA.Toolbar.MyWebSearch
50.00%

Panda Antivirus
Trj/Chgt.D
50.00%

Fortinet FortiGate
Riskware/Toolbar_MyWebSearch
50.00%

The domain software.windownload.net has been seen to resolve to the following 2 IP addresses.

54.231.1.201
s3-1-w.amazonaws.com
December 1, 2014

176.32.98.230
s3-1-w.amazonaws.com
May 1, 2014

File downloads found at URLs served by software.windownload.net.

15 / 68    (Adware)
http://software.windownload.net/itunes_setup.exe  (bd2e0114e1fd8195a3999c4f3525a864)

11 / 68    (Adware)
http://software.windownload.net/itunes_setup.exe  (dde07417325a915dff350a54c2a73fc5)

The following 5 files have been seen to comunicate with software.windownload.net in live environments.

TCP » 176.32.98.230:80
imf.exe (IObit Malware Fighter by IObit)

TCP » 176.32.98.230:80
imf.exe (IObit Malware Fighter by IObit)

TCP » 176.32.98.230:80
imf.exe (IObit Malware Fighter by IObit)

TCP » 176.32.98.230:80
imf.exe (IObit Malware Fighter by IObit)

TCP » 176.32.98.230:80
secureassist.exe (SecureAssist.exe by SecureAssist)

URL:
http://software.windownload.net/

Network:
Amazon Web Services (AWS)

Web server:
AmazonS3

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.