The domain download.popcrew.info is registered by proxy through GoDaddy.com, LLC. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Sao Paulo, Sao Paulo within Brazil which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform.
Registrant:
Domains By Proxy, LLC
Registrar:
GoDaddy.com, LLC
Server location:
Sao Paulo, Brazil (BR)
ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US
Scanner detections:
Detections (98% detected)
Scan engine
Details
Detections
Reason Heuristics
PUP.Startup.Installmatic, PUP.Installmatic, PUP.Bundler.Installmatic, Threat.Installmatic.PopVantage, PUP.Installmatic.WinPops, PUP.Installmatic.Deals4Win, PUP.Installmatic.SuperBargain, PUP.Installmatic.BRDeals (M), PUP.Installmatic.Offers (M), PUP.Installmatic.GoodSales (M), PUP.Installmatic.SupperOffers (M), PUP.Installmatic.SuperShopping (M), PUP.PopDeals.Meta (M), PUP.Installmatic.PopDeals (M), PUP.Installmatic.Sales (M), PUP.Installmatic.SuperFree (M), PUP.Installmatic.SuperBargain (M), PUP.Installmatic.Club (M), PUP.Installmatic.Shop (M), PUP.Installmatic.BestOffe (M), PUP.Installmatic.Supper2O (M)
100.00%
AVG
Generic, DealApp.B, Downloader, Installmatic
42.86%
ESET NOD32
MSIL/Adware.Popdeals (variant)
38.78%
Bkav FE
W32.HfsAdware
36.73%
IKARUS anti.virus
AdWare.MSIL.Popdeals, AdWare.DealApp
34.69%
Baidu Antivirus
PUA.Win32.PopDeals, Adware.Win32.UltraDownloads, Adware.MSIL.Popdeals
34.69%
Qihoo 360 Security
HEUR/QVM03.0.Malware.Gen
24.49%
K7 AntiVirus
Adware
20.41%
Trend Micro House Call
Suspicious_GEN.F47V0223, Suspicious_GEN.F47V0324, Suspicious_GEN.F47V0513, Suspicious_GEN.F47V0222, TROJ_GEN.R03EC0EDE15
18.37%
McAfee
Artemis!9EB75E86100F, Artemis!D288484CF3AA, Artemis!67B7B7CF632B, Artemis!BA889DF12B26, Artemis!9C329E980394, Artemis!EC3B8BA8EF5D
18.37%
VIPRE Antivirus
MSIL.Adware.Popdeals
16.33%
Fortinet FortiGate
Adware/Popdeals, MSIL/MSIL.A, MSIL/Popdeals.G
16.33%
Avira AntiVirus
ADWARE/PopDeals.162872, ADWARE/PopDeals.A.2, ADWARE/PopDeals.102456.1, ADWARE/PopDeals.161336, ADWARE/PopDeals.162872.5
16.33%
Comodo Security
ApplicUnwnt, TrojWare.Win32.Fsysna.CLJ
12.24%
Sophos
Mal/MSIL-LL, PopDeals (PUA)
10.20%
The domain download.popcrew.info has been seen to resolve to the following 22 IP addresses.
s3-website-sa-east-1.amazonaws.com
June 7, 2016
s3-website-sa-east-1.amazonaws.com
June 6, 2016
s3-website-sa-east-1.amazonaws.com
May 24, 2016
s3-website-sa-east-1.amazonaws.com
May 21, 2016
s3-website-sa-east-1.amazonaws.com
April 14, 2016
s3-website-sa-east-1.amazonaws.com
April 6, 2016
s3-website-sa-east-1.amazonaws.com
April 5, 2016
s3-website-sa-east-1.amazonaws.com
March 4, 2016
s3-website-sa-east-1.amazonaws.com
February 29, 2016
s3-website-sa-east-1.amazonaws.com
February 29, 2016
s3-website-sa-east-1.amazonaws.com
February 28, 2016
s3-website-sa-east-1.amazonaws.com
February 28, 2016
s3-website-sa-east-1.amazonaws.com
February 27, 2016
s3-website-sa-east-1.amazonaws.com
February 27, 2016
s3-website-sa-east-1.amazonaws.com
February 23, 2016
s3-website-sa-east-1.amazonaws.com
February 22, 2016
s3-website-sa-east-1.amazonaws.com
February 22, 2016
s3-website-sa-east-1.amazonaws.com
February 21, 2016
s3-website-sa-east-1.amazonaws.com
February 20, 2016
s3-website-sa-east-1.amazonaws.com
February 10, 2016
s3-website-sa-east-1.amazonaws.com
February 9, 2016
s3-website-sa-east-1.amazonaws.com
February 3, 2016
File downloads found at URLs served by download.popcrew.info.
The following 5 files have been seen to comunicate with download.popcrew.info in live environments.
URL:
http://download.popcrew.info/
Network:
Amazon Web Services (AWS)