trk.airinstaller.com

Air Software  (via a Proxy Registrant)

Domain Information

The domain trk.airinstaller.com is registered by proxy through ENOM, INC. and was originally registered in May of 2011. This domain has been known to host and distribute potentially unwanted software. The hosted servers are located in New York City, New York within the United States which resides on the Digital Ocean, Inc. network. The domain is associated with the publisher Air Software who is located in Victoria, British Columbia in Canada.
Remove Malware from trk.airinstaller.com - Powered by Reason Core Security
Registrar:
ENOM, INC.

Server location:
New York, United States (US)

Create date:
Thursday, May 12, 2011

Expires date:
Thursday, May 12, 2016

Updated date:
Saturday, May 02, 2015

ASN:
AS14061 DIGITALOCEAN-ASN - Digital Ocean, Inc.

Root domain:

Scanner detections:
Detections  (96% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Installer.DownloadManager.F, PUP.Installer.TuguuSLU.F, DownloadManager.AirSoftware.M, DownloadManager.AirSoftware.K, DownloadManager.AirSoftware.F, DownloadManager.Bundler.Air Software, PUP.Air Software.AirSoftware.Bundler (M), PUP.Solimba.Bechiro.Bundler (M)
100.00%

K7 AntiVirus
Unwanted-Program , Trojan , Adware
100.00%

K7 Gateway Antivirus
Unwanted-Program
100.00%

Dr.Web
Trojan.SMSSend.4902, Trojan.PayInt.14, Trojan.SMSSend.4684, Adware.Downware.1410, Adware.Downware.1167, Adware.Downware.963
100.00%

VIPRE Antivirus
Iminent, DomaIQ, AirInstaller, Threat.4782985, DownloadMR
100.00%

Avira AntiVirus
ADWARE/Adware.Gen, APPL/DomaIQ.G.2, ADWARE/Adware.Gen7, Adware/AirInst.2556, APPL/Solimba.Gen, TR/Zusy.bmjkonyb
100.00%

Rising Antivirus
PE:PUF.Airinstall!1.9C4C, PE:PUF.DomaIQ!1.9EEB, PE:PUF.FirseriaInstaller@CV!1.5C42
100.00%

AVG
BundleApp_r.D, Skodna.Generic_r, Adware Generic_r.JA, Adware Generic_r.IW, Adware InstallCore.RT, Adware InstallCore.RV
100.00%

Comodo Security
Application.Win32.DomaIQ.D, Application.Win32.AirAdInstaller.B, Application.Win32.AirAdInstaller.A, Application.Win32.Solimba.L
95.45%

Sophos
DomainIQ pay-per install, AirInstaller, PUA 'AirInstaller', Solimba Installer, PUA.AirInstaller
95.45%

Vba32 AntiVirus
AdWare.MSIL.DomaIQ, AdWare.AirAdInstaller, TScope.Trojan.MSIL
95.45%

IKARUS anti.virus
AdWare.DomaIQ, Win32.AdWare, AdWare.Airinstall, PUA.AirAdInstaller, Win32.Malware, PUA.Bechiro
95.45%

avast!
Win32:Malware-gen, Win32:DomaIQ-BB [PUP], Adware-gen [Adw], PUP-gen [PUP], Win32:Adware-CAH [PUP], Win32:Adware-gen [Adw]
90.91%

F-Prot
W32/DomaIQ.B.gen, W32/AirInstall.C.gen, W32/AirInstall.A.gen, W32/AirInstall.D.gen, W32/AirInstall.A8.gen
90.91%

NANO AntiVirus
Trojan.Win32.PayInt.csffwn, Riskware.Win32.AirAdInstaller.cwbltv, Riskware.Win32.Downware.cwfgel, Riskware.Win32.AirAdInstaller.cxhlas
90.91%

The domain trk.airinstaller.com has been seen to resolve to the following 7 IP addresses.

108.168.218.35-static.reverse.softlayer.com
May 3, 2015

173.192.195.228-static.reverse.softlayer.com
May 3, 2015

173.192.195.226-static.reverse.softlayer.com
September 5, 2014

justice.airinstaller.com
May 31, 2014

uswestmeganode1.airinstaller.com
May 7, 2014

chicago.airinstaller.com
May 1, 2014

50.23.68.85-static.reverse.softlayer.com
April 13, 2014

File downloads found at URLs served by trk.airinstaller.com.

11 / 68    (Adware)

The following file have been seen to comunicate with trk.airinstaller.com in live environments.

URL:
http://trk.airinstaller.com/

Title:
“Air Installer ™”

Description:
“Air Installer”

Web server:
Apache/2.2.22 (Ubuntu) (PHP/5.4.31-1+deb.sury.org~precise+1)

Remove Malware from trk.airinstaller.com - Powered by Reason Core Security