home

gogo-download.org

ironSource Technologies Ltd / Install Core

Domain Information

This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Ashburn, Virginia within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform.
Registrar:
PDR Ltd. d/b/a PublicDomainRegistry.com

Server location:
Virginia, United States (US)

ASN:
AS14618 AMAZON-AES - Amazon.com, Inc.,US

Whois:
3 gogo-download.org records

Scanner detections:
Detections  (97% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Installer.NewMedia.Installer, (M), PUP.NewMedia.Installer.NewMediaHoldings.Installer (M), PUP.installCore (M), PUP.NewMedia.Installer.installCore.Installer (M), PUP.NewMedia.Installer.Installer (M), PUP.Installer.Bundler.Installer.Meta (M), PUP.instalCore.InternetGenericweb.Bundler.Meta (M), PUP.InstallCore (M), PUP.InstallCore.Internet.Installer.Meta (M), PUP.NewMedia.NMH.installCore.Installer (M), PUP.InstallCore.RES (M), PUP.InstallCore.RE48 (M), PUP.NewMedia.NMH (M)
97.30%

Microsoft Security Essentials
Worm:Win32/NeksMiner.A
2.70%

F-Secure
Application:W32/Generic.70053c248f!Online
2.70%

Dr.Web
Trojan.InstallCore.152
2.70%

VIPRE Antivirus
Threat.4786018
2.70%

ESET NOD32
Win32/InstallCore.ZM potentially unwanted application
2.70%

Bkav FE
W32.HfsAdware
2.70%

AVG
Generic
2.70%

The domain gogo-download.org has been seen to resolve to the following 7 IP addresses.

209.99.40.219
209-99-40-219.fwd.datafoundry.com
September 4, 2016

54.84.143.69
ec2-54-84-143-69.compute-1.amazonaws.com
October 6, 2015

52.7.132.182
ec2-52-7-132-182.compute-1.amazonaws.com
October 6, 2015

107.23.203.23
ec2-107-23-203-23.compute-1.amazonaws.com
October 6, 2015

54.84.140.114
ec2-54-84-140-114.compute-1.amazonaws.com
May 28, 2015

54.209.232.94
ec2-54-209-232-94.compute-1.amazonaws.com
May 28, 2015

54.236.147.238
ec2-54-236-147-238.compute-1.amazonaws.com
May 28, 2015

File downloads found at URLs served by gogo-download.org.

1 / 68      (Adware)
http://gogo-download.org/?dl=1&pi=Azn4AZg4AZARAi==&osos=VdluDrW3cw==&dr=cHaWck1jIHvJ KLm2r0Wc32lDXiyvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1NKkDj rcWDK4m7z0RvmiWAkDjIKiWXzAwAzAzOZMFASDPDdlChV8RATcyNzA4ATiy&pd=2323UExJck1EIXDlUmNJ i==&campaignId=9jn0AznROTadAZMq  (googlechromesetup.exe)

1 / 68      (PUP)
http://gogo-download.org/?dl=1&pi=Ajg4NzcRNzaFOM==&osos=VdluDrW3cw==&dr=cHaWck1QDKpl2dVBDKitAQD0 T1z2dVl2Zamc3aW7mcmIT1zvm2yIKiWvmREhKVuvmNjhVVTvmNBDz1l QDjhTnmDZ0wvmNpDZ1fNZL4ATcFAZCRvm5EIKiWXzC4OTAFNjgwAjA=&pd=2323UEVwUKvlc3iu7dWt&campaignId=9jn0Ajc1NZiwAZMq  (bejeweled 2setup.exe)

1 / 68      (PUP)
http://gogo-download.org/?dl=1&pi=Ajg4NzcRNzg0Ni==&osos=VdluDrW3cw==&dr=cHaWck13IKFC 32zUK1J2mllUK1PIdVyvExthXN3DKV0vENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1vTQDj rcWDK4m7z0RvmiWAkDjIKiWXzMwOZ7dOTMFASDPDdlChV8wOTndOZ73AZaz&pd=2323UmxJ2d4tcdWm2H2PcmLu7dWt&campaignId=9jn0Ajg0NTg0AZMq  (windowsmoviemakersetup.exe)

1 / 68      (Adware)
http://gogo-download.org/?dl=1&pi=Ajg4NzcyNTMRNM==&osos=VdluDrW3cw==&dr=cHaWck1w r5u2HAt2EAtemWt7mllcyD0 T1z2dVl2ZLmc3aW7mcmIT1zvm2yIKiWvmREhKVuvmNjhVVTvmNBDz1l QDjhTnmDZ0wvmNpDZ1fATa1Nz7FAZCRvm5EIKiWXzMdAZadOZcwAjA=&pd=2323Um2J dxP73xp2mLu7dWt&campaignId=9jn0AjgdOZcwAZMq  (plantsvszombiessetup.exe)

1 / 68      (PUP)
http://gogo-download.org/?dl=1&pi=ATc4Az7RAZL3NM==&osos=VdluDrW3cw==&chnl=b_sa_chwin8&dr=cHaWck1tDKxp7S1w r5FDXam2r0Wc32lDXimc3aW7mcmIT1zvm2yIKiWvmREhKVuvmNjhLlOvmNBDz1l QDjhTnmDZ0wvmNpDZ1fOZaRNT7FAZCRvm5EIKiWXzL4NTL1NZcwAjA=&pd=2323Um2J dit7XswUmNJ i==&campaignId=9jn0AzazNjgwAZMq  (windowsmediaplayersetup.exe)

1 / 68      (PUP)
http://gogo-download.org/?dl=1&pi=Ajg4NzcyNZgdNw==&osos=VdluDrW3cw==&dr=cHaWck1w 3sj 3vuUXxp KLm2r0Wc32lDXimc3aW7mcmIT1zvm2yIKiWvmREhKVuvmNjhLlOvmNBDz1l QDjhTnmDZ0wvmNpDZ1fATM0NjC4AZCRvm5EIKiWXzCwAZ70NTAyNZa=&pd=2323Um2JDd8t2XsB d5CUmNJ i==&campaignId=9jn0AjCRNZ7wAZMq  (popcorntimesetup.exe)

1 / 68      (PUP)
http://gogo-download.org/?dl=1&pi=Ajg4NzcRAzAFAg==&osos=VdluDrW3cw==&dr=cHaWck1JcrVu dDmIKNlvExthXN3DKV0NQDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWVVAm7dREhKVuvmAWASDChTMm7dlChV8yAZM4AZMROTnm7K2pDZ1fOTgyAzMyNTnyAw==&pd=2323Um2l2k1oDXvlUmNJ i==&campaignId=9jn0AjC0AZndAZMq  (openofficesetup.exe)

2 / 68      (false positives)
http://gogo-download.org/?dl=1&pi=ATMwAZizAjayOi==&osos=VdluDrW3cw==&chnl=b_sa_sign_win8&dr=cHaWck1Q HVlc3xP7dtzvExthXN3DKV0NkDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWSL4m7dREhKVuvmAWASDChTMm7dlChV8zNjL4NzgwOTnm7K2pDZ1fOTL1Aji4ATa0Ag==&pd=2323Um5wcHAt mV3UmNJ i==&campaignId=9jn0AzayNjcyAZMq  (wrar420.exe)

1 / 68      (PUP)
http://gogo-download.org/?dl=1&pi=Azi1OTiFAZcyAw==&osos=VdluDrW3cw==&chnl=b_sa_temp|core&dr=hd5C m0WedNyDK50IXDlfSDphXAmD3vpDZ0m rcWDK4m7dAWVVAm7dREhKVuvmAWASDChTMm7dlChVWZiL1iiLlHTlWvxkDG2z1YIdVF2dWyDH0m XiWed1P2rNo2HlwDX0m K4We3sB7KNl KVu2H0m73iWe3xPcm2l2H0m EiWedlmidWu2rVu2ZpnfXtpDlNl7XvjIZpLfSDleHsyhXtP7dVpDH0m7XMWed5CcrWzIXxp dFWvmxdhXtCDXDp7dVWvEsyhXMt KluDKNy7KD0vExthXN3DKV0OSDzcj1QDyDPDdlChVWsxn2ST1ViX0ln&pd=2323UEsB7XCt rlGDSFj d0=&campaignId=9jn0Aza4OTcyAZMq  (minecraftsetup.exe)

1 / 68      (Adware)
http://gogo-download.org/?dl=1&pi=ATcFATMwNjizAw==&osos=VdluDrW3cw==&dr=c3aW7mcm2r0Wc32lDXimcHaWck1E dWE rLtDK5y2rgmIT1zvm2yIKiWvmREhKVuvmNjhLlOvmNBDz1l QDjhTnmDZ0wvmNpDZ1fNjcROZC4AZCRvm5EIKiWXzi4AzLzNzAyNZa=&pd=2323UENJDEx37XvlUK2l2kFj d0=&campaignId=9jn0AzMyAj7wAZMq  (googleearthsetup.exe)

1 / 68      (PUP)
http://gogo-download.org/?dl=1&pi=Ajg4NzcRNzg0Ni==&osos=VdluDrW3cw==&dr=cHaWck1w 3sj 3vuUXxp KLm2r0Wc32lDXimc3aW7mcmIT1zvm2yIKiWvmREhKVuvmNjhVVTvmNBDz1l QDjhTnmDZ0wvmNpDZ1fAj7zNjC4AZCRvm5EIKiWXzC4AzCzNTAyNZa=&pd=2323Um2JDd8t2XsB d5CUmNJ i==&campaignId=9jn0Ajg4ATi4AZMq  (popcorntimesetup.exe)

1 / 68      (PUP)
http://gogo-download.org/?dl=1&pi=ATA0NZM3OTA1Ag==&osos=VdluDrW3cw==&dr=cHaWck1JcrVu dDmIKNlvExthXN3DKV0NQDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWxVAm7dREhKVuvmAWASDChTMm7dlChV8wAZM4AZMROTnm7K2pDZ1fNjgyAzMyNTnyAw==&pd=2323Um2l2k1oDXvlUmNJ i==&campaignId=9jn0AzndAzMwAZMq  (openofficesetup.exe)

1 / 68      (Adware)
http://gogo-download.org/?dl=1&pi=AzawNj7dNjLRAi==&osos=VdluDrW3cw==&dr=cHaWck1mIXvlDmW4vExthXN3DKV0NQDzcj1QDyDphXAmD3vpDZ0m rcWcHim7dAWilam7dREhXs0vmAWASDChTMm7dlChV8dNjC4AZMROTnm7K2pDZ1fAzi4NZnzNTnyAw==&pd=2323UEvP2rLt2XNlUmNJ i==&campaignId=9jn0AjC3OTL4AZMq  (firefoxsetup.exe)

1 / 68      (PUP)
http://gogo-download.org/?dl=1&pi=ATgyNznRNZaFAM==&osos=VdluDrW3cw==&chnl=b_sa_chwin8&dr=cHaWck1EIK1wvExthXN3DKV0AQDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWVVAm7dREhKVuvmAWASDChTMm7dlChV80NjgzNzCwOTnm7K2pDZ1fNTM3NjA0OTMyAw==&pd=2323Um5j2rlJ m5C KlyDSFj d0=&campaignId=9jn0AzaFNjawAZMq  (gimpsetup.exe)

1 / 68      (Malware)
http://gogo-download.org/?dl=1&pi=NZg4AZc4OZM=&osos=VdluDrW3cw==&chnl=b_sa_chwin8&dr=cHaWck1JcmlEIK4m2r0Wc32lDXiyvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1vVkDj rcWDK4m7z0RvmiWAkDjIKiWXzCzNzA3OTMFASDPDdlChV8RAjc1AZiFAZaz&pd=2323Um5j7dVw2rVC2dWy riu7dWt&campaignId=9jn0AzL0AZ70AZMq  (originsetup.exe-setup.website)

1 / 68      (PUP)
http://gogo-download.org/?dl=1&pi=ATayOZMwATLFAg==&osos=VdluDrW3cw==&chnl=b_sa_chwin8&dr=cHaWck1j 3Vu2rVyUXN0cmlGDS1J mRp mLm2r0Wc32lDXidvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1VLyDj rcWDK4m7z0RvmiWAkDjIKiWXzcwNznFOTMFASDPDdlChV80OTAzOZiyATaz&pd=2323Um2yDK50UKtp miu7dWt&campaignId=9jn0AzA3Nj7dAZMq?EsetProtoscanCtx=88aec18  (counterstrikesetup.exe)

1 / 68      (PUP)
http://gogo-download.org/?dl=1&pi=NZnRATawOZ7d&osos=VdluDrW3cw==&chnl=b_sa_chwin8&dr=cHaWck1o 3vpemWuvExthXN3DKV0OSDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWVVAm7dREhKVuvmAWASDChTMm7dlChV83AzAdNTMROTnm7K2pDZ1fNjC4OZA4OZnyAw==&pd=2323UEsjUKtp2dCu7dWt&campaignId=9jn0Azi4AzayAZMq  (horizonsetup.exe)

1 / 68      (PUP)
http://gogo-download.org/?dl=1&pi=Ajg4NzcyAj7yAM==&osos=VdluDrW3cw==&dr=cHaWck1tIKFl73vPDEim2r0Wc32lDXi0vENyhKvEvmCWcyDEcmlChSDBDz1mcQDj7z1rLQDj rcWDEam7z0RvmiWAkDjIKiWXzczAzL1OZMFASDPDdlChV8yATi1AZgFATiy&pd=2323UmRlDdVuDrVyeS1PcHszUmNJ i==&campaignId=9jn0AjgyAjgwAZMq  (minecraftsetup.exe)

1 / 68      (PUP)
http://gogo-download.org/?dl=1&pi=ATi0OTA3NjAFNM==&osos=VdluDrW3cw==&chnl=b_sa_ch&dr=cHaWck1E2r5fSVDfcd5uXd5uDHvl7XAm2r0Wc32lDXidvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1sxSDj rcWDK4m7z0RvmiWAkDjIKiWXznRAZcFOTMFASDPDdlChV8FNzadAZnzATaz&pd=2323Umtp2dCtc3VuUmNJ i==&campaignId=9jn0AzazOT74AZMq  (gtaivsanandreassetup.exe)

1 / 68      (Adware)
http://gogo-download.org/?dl=1&pi=Azn3ATiRNjLyNg==&osos=VdluDrW3cw==&chnl=&dr=cHaWck1JcrVu dDmIKNlvExthXN3DKV0NQDzcj1QDyDphXAmD3vpDZ0m rcWcHim7dAWilam7dREhXs0vmAWASDChTMm7dlChV8yAZAFAZMROTnm7K2pDZ1fNjnyAZAzNTnyAw==&pd=2323Um2l2k1oDXvlUmNJ i==&campaignId=9jn0AzazATcdAZMq  (openofficesetup.exe)

1 / 68      (Adware)
http://gogo-download.org/?dl=1&pi=AzA4OTgRAZiFNw==&osos=VdluDrW3cw==&dr=cHaWck1jIHvJ KLm2r0Wc32lDXiyvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1vTQDj rcWDK4m7z0RvmiWAkDjIKiWXzM1AZMzOZMFASDPDdlChV8wAZaFATa4ATiy&pd=2323UExJck1EIXDlUmNJ i==&campaignId=9jn0AzawAjiyAZMq  (googlechromesetup.exe)

1 / 68      (PUP)
http://gogo-download.org/?dl=1&pi=Azn3NZLRNjA1AM==&osos=VdluDrW3cw==&chnl=b_sa_ch&dr=cHaWck1PDH2j rVP mVyvExthXN3DKV0OSDzcj1QDyDphXAmD3vpDZ0m rcWcHim7dAWilam7dREhXs0vmAWASDChTMm7dlChV80AjCyNjMROTnm7K2pDZ1fNz70OTC3OTnyAw==&pd=2323Um5wcHNGIKFCUmNJ i==&campaignId=9jn0AzizNz74AZMq  (icreinstall_adwcleanersetup.exe)

1 / 68      (PUP)
http://gogo-download.org/?dl=1&pi=AjCwATL4OT73Ng==&osos=VdluDrW3cw==&chnl=b_sa_temp|allrest&dr=cHaWck1NIKFl73vPDEim2r0Wc32lDXidvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1VLyDj rcWDK4m7z0RvmiWAkDjIKiWXzLFAjnFOTM1ASDPDdlChV81OZ7RNznzNZ7y&pd=2323UEsB7XCt rlGDSFj d0=&campaignId=9jn0AzA4NjMyAZMq  (minecraftsetup.exe)

1 / 68      (Adware)
http://gogo-download.org/?dl=1&pi=ATLzNZL1NzC3Aw==&osos=VdluDrW3cw==&chnl=b_sa_sign_win8&dr=cHaWck1jIHvJ KLm2r0Wc32lDXiyvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1sVkDj rcWDK4m7z0RvmiWAkDjIKiWXzC4AjAzOZMFASDPDdlChV8yAjnyNzA4ATiy&pd=2323UExJck1EIXDlUmNJ i==&campaignId=9jn0AzA4NzgyAZMq  (googlechromesetup.exe)

1 / 68      (PUP)
http://gogo-download.org/?dl=1&pi=AT71Az7wNjMdNi==&osos=VdluDrW3cw==&dr=cHaWck1jIHvJ KLm2r0Wc32lDXiyvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1VLyDj rcWDK4m7z0RvmiWAkDjIKiWXzi1AZMzOZMFASDPDdlChV8yOTMwAja4ATiy&pd=2323UExJck1EIXDlUmNJ i==&campaignId=9jn0AjC0OZadAZMq  (googlechromesetup.exe)

1 / 68      (PUP)
http://gogo-download.org/?dl=1&pi=AzM1NzA3NTLyNg==&osos=VdluDrW3cw==&chnl=b_sa_ch&dr=cHaWck1w 3sj 3vuUXxp KLm2r0Wc32lDXimc3aW7mcmIT1zvm2yIKiWvmREhKVuvmNjhLlOvmNBDz1l QDjhTnmDZ0wvmNpDZ1fATM0NjC4AZCRvm5EIKiWXznzAj70NTAyNZa=&pd=2323Um2JDd8t2XsB d5CUmNJ i==&campaignId=9jn0AzLwAZn0AZMq  (popcorntimesetup.exe)

1 / 68      (PUP)
http://gogo-download.org/?dl=1&pi=ATC0NTCwNTc0Oi==&osos=VdluDrW3cw==&chnl=ab-b_sa_chrome_win8_2015_3_25-0&dr=cHaWck1mIKRlemlB rnm2r0Wc32lDXiyvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1vTQDj rcWDK4m7z0RvmiWAkDjIKiWXzAdNjL3OTMFASDPDdlChV81ATMyOTLFAZaz&pd=2323Um5j2rlJ Q1PDr1pcmLu7dWt&campaignId=9jn0AzawNz70AZMq  (filezillasetup.exe)

1 / 68      (Adware)
http://gogo-download.org/?dl=1&pi=ATARAzi0AzLyNw==&osos=VdluDrW3cw==&chnl=b_sa_sign_win8&dr=c3aW7mcm2r0Wc32lDXimcHaWck1zcrW0IKDFvmCWcyDEcmlChSDBDz1l QDj7z1TxSDj rcWDK4m7z0RvmiWAkDjIKiWXz73OT7dOTMFASDPDdlChV8yATa3NTc3AZaz&pd=2323UmxJ2dFB d5CDrW3 QFj d0=&campaignId=9jn0AzayATgdAZMq  (spotifysetup.exe)

1 / 68      (Adware)
http://gogo-download.org/?dl=1&pi=Ajc1OZMROZ7FAw==&osos=VdluDrW3cw==&dr=cHaWck1mIXvlDmW4vExthXN3DKV0NSDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWSL4m7dREhKVuvmAWASDChTMm7dlChV8zAZLdOTgwOTnm7K2pDZ1fNTC4AZ71Aza0Ag==&pd=2323UEvP2rLt2XNlUmNJ i==&campaignId=9jn0AzM0OZndAZMq  (firefoxsetup.exe)

1 / 68      (Adware)
http://gogo-download.org/?dl=1&dr=cHaWck1mcmWz2H2pcmLm2r0Wc32lDXiyvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1VLyDj rcWDK4m7z0RvmiWAkDjIKiWXzA0Nj74Azn0ASDPDdlChV80OZawNjndATMz&pd=2323UExJck1p EN07KRBUmNJ i==&campaignId=9jn0AjLzNzAyAZMq  (frostwiresetup.exe)

 
Latest 30 of 37 download URLs

The following 16 files have been seen to comunicate with gogo-download.org in live environments.

TCP » 209.99.40.219:80
DownloadInjectionSQL.exe

TCP » 209.99.40.219:80
UnLoad.exe

TCP » 209.99.40.219:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 209.99.40.219:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 209.99.40.219:80
minecraft.exe (Minecraft Launcher)

TCP » 209.99.40.219:80
Minecraft.exe (Minecraft Launcher)

TCP » 209.99.40.219:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 209.99.40.219:80
DeleteWebkitCookie.exe

TCP » 209.99.40.219:80
online-guardian-v2.0.9.exe

TCP » 209.99.40.219:80
instatime.exe

TCP » 209.99.40.219:80
onlineguardian-v2.exe

TCP » 209.99.40.219:80
InstallerOrion.exe

TCP » 209.99.40.219:80
ContentSinder.exe (ContentSinder by ContentSinder Company)

TCP » 209.99.40.219:80
InstallMoney.exe

TCP » 54.84.143.69:80
WajamInternetEnhancer.exe (Wajam Internet Enhancer by Wajam Internet Technologies)

TCP » 54.84.143.69:80
notifier64.exe (Notifications)

TCP » 54.84.143.69:80
ContentFinder.exe (ContentFinder by ContentFinder Company)

URL:
http://gogo-download.org/

Title:
“File-Opener”

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
nginx/1.4.7

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.