home

thousand-apps.org

Privacy Protection Service INC d/b/a PrivacyProtect.org  (Proxy Registrant)

Domain Information

The domain thousand-apps.org is registered by proxy through PDR Ltd. d/b/a PublicDomainRegistry.com. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Ashburn, Virginia within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform.
Registrar:
PDR Ltd. d/b/a PublicDomainRegistry.com

Server location:
Virginia, United States (US)

ASN:
AS14618 AMAZON-AES - Amazon.com, Inc.,US

Whois:
1 thousand-apps.org record

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.InstallCore.RE48 (M), PUP.InstallCore.RES (M)
100.00%

The domain thousand-apps.org has been seen to resolve to the following 3 IP addresses.

52.7.132.182
ec2-52-7-132-182.compute-1.amazonaws.com
August 14, 2016

107.23.203.23
ec2-107-23-203-23.compute-1.amazonaws.com
August 14, 2016

54.84.143.69
ec2-54-84-143-69.compute-1.amazonaws.com
August 14, 2016

File downloads found at URLs served by thousand-apps.org.

1 / 68      (PUP)
http://thousand-apps.org/?dl=1&dr=7Kxu T1Y73vl7Xxp2mVWvmt3hXtGDXl3 3vCfSDt2Z1Y K507dP0eXslfSDt j1YcrRP7dVtDKF0fSDj2Z1Y2r5yDdV0fSDu2Z1YIKDZ dF0DKF0OCxWedlmLdVPcmNoOlxWvmV4cHaWed5jDKlCfSDPcZ1Y7Kxw 3Np2rlJ E0mDH7Wedxl2mljDX0mcHaWck13IKFC 32zUK1J2mllUK1PIdVyvExthKFC2ZLmc3aWc3vjvmCWcyDEcmlChSDBDz1w2kDj7z1kLQDj rcWcHim7z0RvmiWAkDjIKiWXznwNT7FNzAdAQDPDdlChV8RAj7FOZCwOZidAS7R&pd=2323UmPlcmLt2SFj d0=&campaignId=9jn0AjLyAzidAZMq  (windowsmoviemaker_setup.exe)

1 / 68      (PUP)
http://thousand-apps.org/?dl=1&dr=7Kxu T1Y73vl7Xxp2mVWvmt3hXtGDXl3 3vCfSDt2Z1Y K507dP0eXslfSDt j1YcrRP7dVtDKF0fSDj2Z1Y2r5yDdV0fSDu2Z1YIKDZ dF0DKF0OCxWedlmLdVPcmNoOlxWvmV4cHaWed5jDKlCfSDPcZ1Y7Kxw 3Np2rlJ E0mDH7Wedxl2mljDX0mcHaWck1q7XDPvExthKFC2ZLmc3aWc3vjvmCWcyDEcmlChSDBDz1l QDj7z1VLyDj rcWDK4m7z0RvmiWAkDjIKiWXzM4OZL4OZi3AQDPDdlChV8wNjndOTnzOTcwAg==&pd=2323UmPlcmLtDd8u7dWt&campaignId=9jn0AjLyAjLdAZMq  (javasetup.exe)

The following 3 files have been seen to comunicate with thousand-apps.org in live environments.

TCP » 54.84.143.69:80
WajamInternetEnhancer.exe (Wajam Internet Enhancer by Wajam Internet Technologies)

TCP » 54.84.143.69:80
notifier64.exe (Notifications)

TCP » 54.84.143.69:80
ContentFinder.exe (ContentFinder by ContentFinder Company)

URL:
http://thousand-apps.org/

Google Analytics:
UA-57646541

Title:
“File-Opener”

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
nginx/1.4.7

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.