home

www.debsoft.com

Ivan Zaycev

Domain Information

The domain www.debsoft.com registered by Ivan Zaycev was initially registered in December of 2010 through GODADDY.COM, LLC. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Scottsdale, Arizona within the United States which resides on the GoDaddy.com, LLC network.
Registrar:
GODADDY.COM, LLC

Server location:
Arizona, United States (US)

Create date:
Wednesday, December 29, 2010

Expires date:
Thursday, December 29, 2016

Updated date:
Saturday, January 2, 2016

ASN:
AS26496 AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC,US

Root domain:
debsoft.com

Whois:
4 debsoft.com records

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Installer.InformationTechnologySystemsdoo.L, PUP.installCore.InformationTechnologySystemsdoo (M), Adware.Downloader (M), PUP.Coinis.installCore.Installer (M), PUP.Coinis (M)
100.00%

VIPRE Antivirus
Threat.4786018, Threat.4150696
37.50%

Malwarebytes
PUP.Optional.InstallCore, PUP.Optional.Installcore, PUP.Optional.Dropper
37.50%

K7 AntiVirus
Unwanted-Program
37.50%

Sophos
Install Core Click run software
37.50%

Avira AntiVirus
Adware/InstallCore.A.406, TR/Injector.738840, Adware/InstallCore.PK.5
37.50%

ESET NOD32
Win32/InstallCore.PO potentially unwanted application, Win32/Injected.F trojan, Win32/InstallCore.PK potentially unwanted application
37.50%

AVG
Generic
37.50%

SUPERAntiSpyware
PUP.InstallCore/Variant
25.00%

avast!
Malware-gen
12.50%

Dr.Web
Trojan.Packed.28587
12.50%

McAfee
CryptInno
12.50%

Agnitum Outpost
Trojan.Injected
12.50%

Vba32 AntiVirus
Downware.InstallCore
12.50%

IKARUS anti.virus
Trojan.Injector
12.50%

The domain www.debsoft.com has been seen to resolve to the following 9 IP addresses.

54.210.33.190
ec2-54-210-33-190.compute-1.amazonaws.com
September 16, 2016

54.236.123.224
ec2-54-236-123-224.compute-1.amazonaws.com
August 8, 2016

52.206.43.234
ec2-52-206-43-234.compute-1.amazonaws.com
August 8, 2016

52.4.72.137
ec2-52-4-72-137.compute-1.amazonaws.com
August 8, 2016

107.23.198.240
ec2-107-23-198-240.compute-1.amazonaws.com
August 8, 2016

50.63.202.35
ip-50-63-202-35.ip.secureserver.net
January 6, 2016

104.31.85.202
December 26, 2015

104.31.84.202
December 26, 2015

198.7.62.177
hosted-by.leaseweb.com
September 5, 2014

File downloads found at URLs served by www.debsoft.com.

1 / 68      (Adware)
http://www.debsoft.com/.../getfile.php?id=192163&lp_id=186&dist_id=28&channel=adcfl282&src=adc&pbsid=1404604722820_1404604697095_120_470_54222703_1  (install_flashplayer.exe)

1 / 68      (Adware)
http://www.debsoft.com/.../getfile.php?id=192206&lp_id=187&dist_id=373&channel=adc_debjava1&src=adc&pbsid=1404146573799_1404146564134_111_371_153622957_1  (java_setup.exe)

1 / 68      (Adware)
http://www.debsoft.com/.../getfile.php?id=192206&lp_id=187&dist_id=373&channel=adc_debjava1&src=adc&pbsid=1404184359382_1404184338011_119_549_13921813_1  (java_setup.exe)

1 / 68      (PUP)
http://www.debsoft.com/.../getfile.php?id=192163&lp_id=186&dist_id=20&channel=adcfl1&src=adc&pbsid=1404604647615_1404604639210_117_443_97711587_1  (install_flashplayer.exe)

1 / 68      (Adware)
http://www.debsoft.com/.../getfile.php?id=192163&lp_id=186&dist_id=20&channel=adcfl1&src=adc&pbsid=1403811701737_1403811694710_116_320_22226042_1  (install_flashplayer.exe)

10 / 68    (Adware)
http://www.debsoft.com/.../getfile.php?id=192206&lp_id=187&dist_id=373&channel=adc_debjava1&src=adc&pbsid=1404364069915_1404364068744_117_512_10427_1  (java_setup.exe)

15 / 68    (Adware)
http://www.debsoft.com/.../getfile.php?id=192147&lp_id=241&dist_id=28&channel=adcfl282&src=adc&pbsid=1403804413455_1403804356600_121_434_10339625_1  (flash_setup.exe)

9 / 68      (Adware)
http://www.debsoft.com/.../getfile.php?id=192147&lp_id=236&dist_id=20&channel=adcfl1&src=adc&pbsid=1404938399214_1404938391253_111_2967_34363540_1  (flash_setup.exe)

The following 25 files have been seen to comunicate with www.debsoft.com in live environments.

TCP » 50.63.202.35:80
ContentFinder.exe (ContentFinder by DigitalSoftware Group)

TCP » 52.206.43.234:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.206.43.234:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 50.63.202.35:80
browser.exe (Speed Browser by Smart Applications)

TCP » 52.206.43.234:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.206.43.234:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 50.63.202.35:80
Video Player.exe (system video player)

TCP » 50.63.202.35:80
browser.exe (speed browser by Smart Applications)

TCP » 50.63.202.35:443
browser.exe (speed browser by Smart Applications)

TCP » 50.63.202.35:80
online-guardian-v2.0.9.exe

TCP » 50.63.202.35:80
Video Player.exe (system video player)

TCP » 50.63.202.35:80
browser.exe (Speed Browser by Long Mile Solutions)

TCP » 50.63.202.35:80
emuletorrent.exe

TCP » 50.63.202.35:80
crossbrowse.exe (Crossbrowse)

TCP » 50.63.202.35:80
produpd.exe (produpd.exe by Vested Development, Inc)

TCP » 50.63.202.35:80
mybrowser.exe (MyBrowser)

TCP » 50.63.202.35:80
ContentFinder.exe (ContentFinder by ContentFinder Company)

TCP » 50.63.202.35:443
browser.exe (speed browser by Smart Applications)

TCP » 50.63.202.35:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 50.63.202.35:80
mybrowser.exe (MyBrowser)

 
Latest 20 of 30 files

URL:
http://www.debsoft.com/

Web server:
Microsoft-IIS/7.5 (ASP.NET) (Version: 4.0.30319)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.