home

35234.get-wn.net

Starline Alliance LTD.

Domain Information

The domain 35234.get-wn.net registered by Starline Alliance LTD. was initially registered in September of 2014 through PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Beauharnois, Quebec within Canada.
Registrar:
PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM

Server location:
Quebec, Canada (CA)

Create date:
Monday, September 22, 2014

Expires date:
Tuesday, September 22, 2015

Updated date:
Monday, September 22, 2014

ASN:
AS16276 OVH OVH SAS, FR

Root domain:
get-wn.net

Whois:
1 get-wn.net record

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Installer.ROSA.T, PUP.SOFTON.Installer (M)
100.00%

Avira AntiVirus
APPL/Downloader.Gen9, APPL/Downloader.Gen4
50.00%

ESET NOD32
Win32/bmMedia.CG, Win32/bmMedia.BN
50.00%

AVG
Generic
50.00%

avast!
Win32:Rootkit-gen [Rtk], Win32:Malware-gen
50.00%

Dr.Web
Trojan.Packed.29079
50.00%

Agnitum Outpost
Riskware.Agent
50.00%

Total Defense
Win32/Tnega.KeXXEFB
25.00%

VIPRE Antivirus
Threat.4150696
25.00%

MicroWorld eScan
Gen:Variant.Kazy.473220
25.00%

NANO AntiVirus
Trojan.Win32.BmMedia.dguxsz
25.00%

F-Prot
W32/A-f6131de3
25.00%

Bitdefender
Gen:Variant.Kazy.473220
25.00%

AegisLab AV Signature
Troj.W32.Buzus
25.00%

Lavasoft Ad-Aware
Gen:Variant.Kazy.473220
25.00%

The domain 35234.get-wn.net has been seen to resolve to the following 2 IP addresses.

158.69.145.50
August 8, 2016

206.54.164.237
October 20, 2014

File downloads found at URLs served by 35234.get-wn.net.

1 / 68      (Adware)
http://35234.get-wn.net/?id=t1f3&nor=1&sub=&name=&url=  (downloadsetup_45shx.exe)

17 / 68    (Adware)
http://35234.get-wn.net/?id=t1f3&nor=1&sub=&name=&url=  (downloadsetup_26vjl.exe)

8 / 68      (Adware)
http://35234.get-wn.net/?id=t1f3&nor=1&sub=&name=&url=  (downloadsetup_11aod.exe)

1 / 68      (Adware)
http://35234.get-wn.net/?id=t1f3&nor=1&sub=&name=&url=  (downloadsetup_35h7c.exe)

The following file have been seen to comunicate with 35234.get-wn.net in live environments.

TCP » 158.69.145.50:80
torrenthandler.crx

URL:
http://35234.get-wn.net/

Google Analytics:
UA-37292325

Title:
“DownloadFileSetup downloading...”

Web server:
nginx (PHP/5.3.10-1ubuntu3.9)

dl-gate.net

dll-wn.net

getddl.net

getfl.net

tusoftware.org

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.