home

d.greatdownflash.com

Privacy Protection Service INC d/b/a PrivacyProtect.org  (Proxy Registrant)

Domain Information

The domain d.greatdownflash.com is registered by proxy through PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM and was originally registered in February of 2015. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter.
Registrar:
PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM

Server location:
Oregon, United States (US)

Create date:
Tuesday, February 10, 2015

Expires date:
Friday, February 10, 2017

Updated date:
Wednesday, February 10, 2016

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
greatdownflash.com

Whois:
2 greatdownflash.com records

Scanner detections:
Detections  (91% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.InstallCore.FC.Installer (M), PUP.InstallCore.RES (M)
90.00%

ESET NOD32
Win32/InstallCore.ZC potentially unwanted application
10.00%

K7 AntiVirus
Trojan
10.00%

NANO AntiVirus
Riskware.Win32.InstallCore.dsmvqg
10.00%

Agnitum Outpost
PUA.InstallCore
10.00%

Comodo Security
Application.Win32.InstallCore.DQT
10.00%

Avira AntiVirus
PUA/InstallCore.A.620
10.00%

G Data
Win32.Application.InstallCore.EG
10.00%

Vba32 AntiVirus
Malware-Cryptor.InstallCore.gen
10.00%

The domain d.greatdownflash.com has been seen to resolve to the following 4 IP addresses.

52.10.47.132
ec2-52-10-47-132.us-west-2.compute.amazonaws.com
May 18, 2016

52.35.246.224
ec2-52-35-246-224.us-west-2.compute.amazonaws.com
May 17, 2016

54.191.197.143
ec2-54-191-197-143.us-west-2.compute.amazonaws.com
April 18, 2016

54.201.74.166
ec2-54-201-74-166.us-west-2.compute.amazonaws.com
July 16, 2015

File downloads found at URLs served by d.greatdownflash.com.

1 / 68      (PUP)
http://d.greatdownflash.com/c?x=/zKvr5EMTS4faZmJkGAEraMUDz8/hgfAh9KbZjU7vrk=&c=8jqRAU2 YS l7Dtjm9KezlX/Mc92HogPc8NJqqaHpe txgdnqv01CdW5SSToCy3ipFmor5ydaTWL RGhsW09ww==&fallback_url=http://download.dvdvideosoft.com/.../FreeYouTubeDownload.exe  (free-youtube-download-3-2-53-128-32-bits.exe)

1 / 68      (PUP)
http://d.greatdownflash.com/c?x=susWuRb1EXSOAM4E bmzSRCV81y9d7YqhQ770NsEPTk=&c=JwLXUQ6t3L5jSJJWOMXpLhtcqLynK4bzJnP6UuHtKAE53ry3t44SxyTv t8B076BVI1pygnJRcaDqzFsfOaNAQ==&fallback_url=http://cdn.agenciatechh.com/.../SuperTela-ptBR.exe  (super-tela-6-0-0-3-32-bits.exe)

1 / 68      (PUP)
http://d.greatdownflash.com/c?x=hONTRsxC/dqwLYCwDrv/sCS97hWoQgHJNlHEe48hHTY=&c=sDS74LBYTtCIpXnrO Ak6dExG hNBTOMofU2r7YS7q mpLpkWsbHjZtRx6 MmlBWwzwegtydpGQS9x/l60suQA==&fallback_url=http://sourceforge.net/projects/orwelldevcpp/files/Setup Releases/.../download  (dev-c-5-9-2-32-bits.exe)

1 / 68      (PUP)
http://d.greatdownflash.com/c?x=bsH8OcCbck3UKt4B QSlfNT0Hl/MW5eivtOJ9uwouNg=&c=Oz5WqII2BN5C1/qk3 LL2rhLq4pwyUGPOy2jmIAK72XJrQVlBzsfxXaUPiJl/8nBK 1R6aN6zynaoL2blTSwkg==&fallback_url=http://files.myplaycity.com/.../farmfrenzy2_setup.exe  (farm-frenzy-2-1-0-2-32-bits.exe)

1 / 68      (PUP)
http://d.greatdownflash.com/c?x=SwPvHRNCuWmKY8R7MZTQn5xhJ6efFQTep5monXb QgQ=&c=SoMIf62t7gxKOOshE5dE9wL2sAUkScUGAu0bbckTzxnmmVezlTQth89NEaAKCND1DBqfc4GP9bOzam gaIeYNA==&fallback_url=https://.../#!CUNQ3K6L!w86MCRq5_ygiQPxQsL9DUydReYJJrIli-zg2GuD3R6E  (photoscape-3-7-32-bits.exe)

1 / 68      (PUP)
http://d.greatdownflash.com/c?x=x02gzR7NybQ1gQ3ioGXDIRn1QkP ynTBwoEPI8/kYwk=&c=n4bT/3vrcWBzEh3SW4Wa92PuhNVqMNnRL58B1jjKpsQp5utfa01QZjdPJxvFn2w6QUH7xnqhCDJ0t/yuxMy1iQ==&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/35.0.1/win32/.../Firefox Setup 35.0.1.exe  (mozilla-firefox-35-0-1-32-bits.exe)

0 / 68
http://d.greatdownflash.com/c?x=ZUwqtxnDtsc T1FXaG UcaBGE3akyFJ5S8gfoSmXpVo=&c=4 zJhC7Cunzqj80gZNxhFXPKKGSxdWaGYN9KtGb4XMk7/ge0kG1QRvPk6l/onkQP3FEkCR4PeFC/FlXY6DD5mg==&fallback_url=http://client-software.real.com/free/windows/installer/stubinst/stub/rp16/.../RealPlayer_br.exe  (rnupdate0.exe)

1 / 68      (PUP)
http://d.greatdownflash.com/c?x=wddJhBwcmS/lPJSsoebV52DqZ3TF/GR1CUL9mbjcUTo=&c=Z0LLS3ZOghRZ684A 4oIDdVoxFfCrG3ApJ7sUV1rG QfhFDo2 s4jekWHyTJ7XtWGL0NM 4a EAAgbsWQ9cLmQ==&fallback_url=https://secure-appldnld.apple.com/itunes12/.../iTunesSetup.exe  (itunes-12-1-1-4-32-bits.exe)

1 / 68      (PUP)
http://d.greatdownflash.com/c?x=gq8ErqomVu8U13M6EjvVGI8FHV7MWHIT4UCcv7TPLPM=&c=1uQPd/PsvRlAotQL8AnLty4O18SfF9TboFkSR0LghNYRl0Mef9qZI4lA/EvoJoAThQRV/8Ex9MY8R1QQ6EvL2A==&fallback_url=http://download.dvdvideosoft.com/.../FreeYouTubeDownload.exe  (free-youtube-download-3-2-53-128-32-bits.exe)

1 / 68      (Adware)
http://d.greatdownflash.com/c?x=x3fLcc4Tk7VcB8kCJ6V8XwSXS9HDm5Y0rqLQ8O1QR M=&c=oCMP7yd1T3lSfgaC0mJPuv63vMBjPBPcNk7pfIOhNp uKkip8IQxzx6Y/izg 4dwWtVfBnRDiH36sB7GRDzFWg==&fallback_url=http://www5l.incredimail.com/im/imsetup/201111140101/default/installer/.../IncrediMailSetup.exe  (incredimail-2-6-39-build-5274-32-bits.exe)

8 / 68      (PUP)
http://d.greatdownflash.com/c?x=UwQHRmnqMSkCN0xoulvoBmgd/A izxgul1maxeld/bU=&c=4qOh9fs yG91FFwvVFpNRdc4zmaGF1 HD4 oziBecdvqNjJHaLajVeAsCV1cakZN93X1M3 msKe41ebghf2tQ==&fallback_url=http://sourceforge.net/projects/portableapps/files/uTorrent Portable/.../download  (utorrent-portable-3-4-2-build-38397-32-bits.exe)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.