home

d.thefailsmail.net

Whois Privacy Corp.

Domain Information

The domain d.thefailsmail.net registered by Whois Privacy Corp. was initially registered in March of 2015 through TLD REGISTRAR SOLUTIONS LTD. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Salt Lake City, Utah within the United States which resides on the Hosting Services, Inc. network.
Registrar:
TLD REGISTRAR SOLUTIONS LTD

Server location:
Utah, United States (US)

Create date:
Thursday, March 5, 2015

Expires date:
Saturday, March 5, 2016

Updated date:
Thursday, March 5, 2015

ASN:
AS29854 WESTHOST - WestHost, Inc.,US

Root domain:
thefailsmail.net

Whois:
1 thefailsmail.net record

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

ESET NOD32
Win32/ExpressDownloader.K potentially unwanted application, Detection.Undefined
100.00%

Reason Heuristics
PUP.Installer.FaglaroEnterprises, PUP.CandyMandy.Installer (M)
75.00%

VIPRE Antivirus
Threat.4783941, Trojan.Win32.Generic.pak!cobra
75.00%

Emsisoft Anti-Malware
Gen:Variant.Strictor.79472, Gen:Variant.Symmi.41072
75.00%

Lavasoft Ad-Aware
Gen:Variant.Strictor.79472, Gen:Variant.Symmi.41072
75.00%

MicroWorld eScan
Gen:Variant.Strictor.79472, Gen:Variant.Symmi.41072
75.00%

Malwarebytes
PUP.Optional.SmileFiles.A
75.00%

avast!
Win32:Downloader-TSH [PUP]
50.00%

F-Secure
Gen:Variant.Strictor.79472
50.00%

Sophos
PUA 'Smile Files Downloader' (of type Adware)
50.00%

K7 AntiVirus
Unwanted-Program
50.00%

Bitdefender
Gen:Variant.Strictor.79472, Gen:Variant.Symmi.41072
50.00%

Avira AntiVirus
APPL/Downloader.Gen4
50.00%

G Data
Gen:Variant.Strictor.79472, Gen:Variant.Symmi.41072
50.00%

AVG
Faglaro Enterprises Limited, Generic
50.00%

The domain d.thefailsmail.net has been seen to resolve to the following IP address.

199.195.196.180
199.195.196.180.static.midphase.com
June 26, 2015

File downloads found at URLs served by d.thefailsmail.net.

1 / 68      (PUP)
http://d.thefailsmail.net/j5GARHHVp09v1aFMIde3aF3TszNloasuPYGzKHOmhDZspYswB KqcBWmiXRPvJgXR7ObQUaTxFoC1spXDNoxRA7KdgIgmW1Gd8Q9TH3NI6U nWfzPGVr1D9gILx8fFPyOGpM9D1kUOsDKRi5CXRYwAUhBIEGREr0HktO20dcKdYfSDbZ50Rn2OlZa8vuSw6g4Uk7s A5ZJ7FYi q yQ sPIlBrz9PgbmlnIZu9kHGJOTbUPenFJK35hVSt UWbfCmBnkqKoR pP7FrTJqRyoZfZPpz/ltq86tL2sO K6mSHtucMg1vKfItGy2H7X2/kFgvuIQpyG2kqCmYkJitquV4vPsWhr1PQJMZK/XmTc7HI4hOB/.../cJwNRnnFKc8MwTH8=  (essentials_of_software_engineering,_3rd_edition_downloader.exe)

11 / 68    (Adware)
http://d.thefailsmail.net/j5G2R27RulMtxL9QId2paGXZrCB3rv8/Zfnseyj 1mAp/NZlBKOcOU w0G4a6MJbHe7TF1OSjQVTlqIGXtUyVUqeZBEkmWokMo19GnfNN AilXbsbzE//zJ3Quc1e1WuKmRA9gZjR/4SOk7wBz5Fxx1DVsgHTk3ZDxlo/FxaJNIScybb61Mi5OhbcI sTDWw0VUl qB0d/qldHP7r2ZQ561qELb9OAiozmkI559sE4GaPUyChwIc39BcSdveWuXH316wkfZJv8LyF6uKq0XSS gQ8jq37r9ot/CgO/z403y6 cZjvfnNJtSji22L9tUe36 EEcaGzRaVlptEn9H8UMea/.../h2mIR7Q==  (splash_pro_ex_keygen_downloader.exe)

15 / 68    (PUP)
http://d.thefailsmail.net/j5GBWHbvgVpl35JtZdelMFH5uyB qaojSYCoLTy8km4v NdhEOHaYxbjyyxfupgHE 3FVwbRyl0QlJwdToZkAWGFYUpx1n0JJ5JrFimnZfo mSi/dGN14jVvIL58fEXgAWRK5BYtXfMDdUnsBH1FjQ1zWIEGREr0FUtIwQ5aOI4rf2PF51El5OVYJNzhZz sswxzs/YzBqLmeWT5tH5Q/aZ S WWZU uxwsFvtkwTNeaZUHehgZJioRXSdzcCbTL2lnnwfMWvcnwQb d h6oJbsdqESapvVs6 HzKbnp1S7zvYNnkP/NboXg8naOpYMUyO7USZadiBzAkIUJjpWiAdjHoE4/0/.../ZsnRq3ud1IaPoeiHwvy4r tgyKq7WMkb2mTRUoNBuGeHGWg==  (dot_hack_roots_english_dub.zip)

18 / 68    (Adware)
http://d.thefailsmail.net/j5G3UnTZulJp2uBPZc 0MX7TvClm7b8kY7apJzevkzJ6qcMjUe3YbxTi2Wwe4MJbCK ABVuExFoG1MlXDt4nA1 ecRknglYSIsk WT6KcOUolXbYJnlp7msxO w2YUL4Yz0D4wZjdvMJZ1miHnBUwgpvW8IGDlrEGwJJywl3ItwLQjHF w0c6KBGKN7mZzKv518 mPwvZPuwMDm8xSER7q91XfmWZUfqkm1D7Z5rV5bPAx2GwQhE34JdSdaODrGSjF xxKQRvMOiQe/J x6lMfhJp2Xi5qAto WgTJKuzXTj6csxgfHdJsuli2 Y99VWjejqTpadixzQ1txBnpX0BM6e40M/0e9QY83wWW7bsHY5ju0kdvDpfST25Hl//4Nkeq7UbkCyjGwT7Ix5WreDFxPtxl4F2Q==  (revision-powerpoint-fourth-grade_downloader.exe)

The following 19 files have been seen to comunicate with d.thefailsmail.net in live environments.

TCP » 199.195.196.180:80
EFupdater.exe (Express Files Updater by http://www.express-files.com/)

TCP » 199.195.196.180:80
EFupdater.exe

TCP » 199.195.196.180:80
EFupdater.exe (Express Files Updater by http://www.express-files.com/)

TCP » 199.195.196.180:80
ExpressFiles.exe (ExpressFiles Application by http://www.express-files.com/)

TCP » 199.195.196.180:80
EFupdater.exe

TCP » 199.195.196.180:80
uninstall433109428.exe (ExpressFiles Application by http://www.express-files.com/)

TCP » 199.195.196.180:80
ExpressFiles.exe (ExpressFiles Application by http://www.express-files.com/)

TCP » 199.195.196.180:80
EFupdater.exe (Express Files Updater by http://www.express-files.com/)

TCP » 199.195.196.180:80
EFupdater.exe (Express Files Updater by http://www.express-files.com/)

TCP » 199.195.196.180:80
EFupdater.exe (Express Files Updater by http://www.express-files.com/)

TCP » 199.195.196.180:80
ExpressFiles.exe (ExpressFiles Application by http://www.express-files.com/)

TCP » 199.195.196.180:80
EFupdater.exe

TCP » 199.195.196.180:80
ExpressFiles.exe (ExpressFiles Application by http://www.express-files.com/)

TCP » 199.195.196.180:80
EFupdater.exe

TCP » 199.195.196.180:80
ExpressFiles.exe (ExpressFiles Application by http://www.express-files.com/)

TCP » 199.195.196.180:80
ExpressFiles.exe (ExpressFiles Application by http://www.express-files.com/)

TCP » 199.195.196.180:80
ExpressFiles.exe (ExpressFiles Application by http://www.express-files.com/)

TCP » 199.195.196.180:80
EFupdater.exe (Express Files Updater by http://www.express-files.com/)

TCP » 199.195.196.180:80
uninstall.exe (ExpressFiles Application by http://www.express-files.com/)

URL:
http://d.thefailsmail.net/

Web server:
nginx/1.2.1

archievedownload.com

archievedownload.net

down4loading.net

down4loadist.net

express-files.com

failsmail.com

go-for-files.biz

go-for-files.com

smile-file.com

smile-files.com

yfdownloader.com

yfdownloader.net

yofiledo.com

yorfiled.com

your-fd.net

yourfaild.net

yourfd.net

yourfdownloader.com

yourfdownloader.net

yourfiledl.com

yourfiledownloader.biz

yourfiledownloader.com

yourfiledownloader.info

yourfiledownloader.net

yourfiledownloader.org

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.