» down-great.info
Overview
Analysis
IPs Addresses (3)
Downloads (29)
Subdomains (1)
Website Detail

down-great.info

Privacy Protection Service INC d/b/a PrivacyProtect.org (Proxy Registrant)

Domain Information

The domain down-great.info is registered by proxy through PDR Ltd. d/b/a PublicDomainRegistry.com. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Ashburn, Virginia within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform.

Registrant:

Privacy Protection Service INC d/b/a PrivacyProtect.org

Registrar:

PDR Ltd. d/b/a PublicDomainRegistry.com

Server location:

Virginia, United States (US)

ASN:

AS14618 AMAZON-AES - Amazon.com, Inc.,US

Whois:

2 down-great.info records

Scanner detections:

Detections (93% detected)

Scan engine

Details

Detections

Reason Heuristics

PUP.InstallCore.Installer.Meta, PUP.installCore (M), PUP.Installer.Bundler.Installer.Meta (M), PUP.NewMedia.Installer.installCore.Installer (M), PUP.InstallCore (M), PUP.InstallCore.S (M), PUP.NewMedia.NMH.installCore.Installer (M), PUP.InstallCore.RES (M), PUP.InstallCore.Internet.Installer.Meta (M), PUP.InstallCore.RE48 (M)

96.30%

G Data

Win32.Application.InstallCore.EG

7.41%

VIPRE Antivirus

Trojan.Win32.Generic, Threat.4150696

7.41%

Vba32 AntiVirus

Malware-Cryptor.InstallCore.gen

7.41%

avast!

Win32:Dropper-gen [Drp]

3.70%

Avira AntiVirus

PUA/InstallCore.EG.100

3.70%

McAfee

Artemis!86BC2CC76EEC

3.70%

Qihoo 360 Security

Win32/Virus.267

3.70%

ESET NOD32

Win32/InstallCore.AAE potentially unwanted application

3.70%

Malwarebytes

PUP.Optional.InstallCore.A

3.70%

K7 AntiVirus

Adware

3.70%

Agnitum Outpost

PUA.InstallCore

3.70%

The domain down-great.info has been seen to resolve to the following 3 IP addresses.

54.88.93.196

ec2-54-88-93-196.compute-1.amazonaws.com

April 16, 2016

54.88.203.136

ec2-54-88-203-136.compute-1.amazonaws.com

July 12, 2015

54.84.209.207

ec2-54-84-209-207.compute-1.amazonaws.com

June 30, 2015

File downloads found at URLs served by down-great.info.

1 / 68 (PUP)

http://down-great.info/?dl=1&pi=ATa4NzLdAzL4Ai==&osos=VdluDrW3cw==&chnl=b_sa_chwin8&dr=cHaWck1tDKxp7S1i r5FDXam2r0Wc32lDXiyvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1VLyDj rcWDK4m7z0RvmiWAkDjIKiWXzAzATLdOTMFASDPDdlChV80OTLRNji3AZaz&pd=2323Um2J dit7XswUmNJ i==&campaignId=9jn0AzaRAziwAZMq (windowsmediaplayersetup.exe)

1 / 68 (PUP)

http://down-great.info/?dl=1&pi=OTMFAzLwOZc=&osos=VdluDrW3cw==&chnl=b_sa_chwin8&dr=cHaWck1wIrW0 3Nj7XslvExthXN3DKV0vENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1sxSDj rcWDK4m7z0RvmiWAkDjIKiWXzLFNzCdOTMFASDPDdlChV8FAT7zOTa4AZaz&pd=2323UEVwUKluc3xP rwu7dWt&campaignId=9jn0AzA1OZg0AZMq (photoscapesetup.exe)

1 / 68 (PUP)

http://down-great.info/?dl=1&pi=ATLwAjCwNTMwNi==&osos=VdluDrW3cw==&dr=cHaWck13IKFC 32zUK1J2mllUK1PIdVyvExthXN3DKV0vENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1vVkDj rcWDK4m7z0RvmiWAkDjIKiWXzAROZ7dOTMFASDPDdlChV8yNzi4OT73AZaz&pd=2323UmxJ2d4tcdWm2H2PcmLu7dWt&campaignId=9jn0AzMyATcwAZMq (windowsmoviemakersetup.exe)

1 / 68 (Adware)

http://down-great.info/?dl=1&pi=ATL4NzC1NTLzAM==&osos=VdluDrW3cw==&dr=cHaWck1jIHvJ KLm2r0Wc32lDXiyvENyhKvEvmCWcyDEcmlChSDBDz1p2kDj7z1vVkDj rcWIXim7z0RvmiWAkDjIKiWXzLzNZczOZMFASDPDdlChV8wAZaRNjC4ATiy&pd=2323UExJck1EIXDlUmNJ i==&campaignId=9jn0Azn3OTc0AZMq (googlechromesetup.exe)

1 / 68 (PUP)

http://down-great.info/?dl=1&pi=ATAyNjLRNjM1Aw==&osos=VdluDrW3cw==&dr=cHaWck1mIXvlDmW4vExthXN3DKV0AQDzcj1QDyDphXAmD3vpDZ0m rcWIXim7dAWSVim7dREhKl0vmAWASDChTMm7dlChV81AjCwNjgwOTnm7K2pDZ1fNjgzNjcFOTn0Ag==&pd=2323UEvP2rLt2XNlUmNJ i==&campaignId=9jn0AzM1NTn4AZMq (firefoxsetup.exe)

1 / 68 (PUP)

http://down-great.info/d/ndt5/.../?dl=1&pi=OZLRAzg4Azi3&osos=VdluDrW3cw==&chnl=b_sa_temp&chnl=b_sa_temp&pd=2323UEsB7XCt rlGDSFj d0=&campaignId=9jn0AzaFAzgdAZMq (fileopenersetup.exe)

1 / 68 (Adware)

http://down-great.info/?dl=1&pi=ATi0Az7wNZcdAM==&osos=VdluDrW3cw==&dr=cHaWck1jIHvJ KLm2r0Wc32lDXiyvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1HiQDj rcWDK4m7z0RvmiWAkDjIKiWXziwAzAzOZMFASDPDdlChV8wOTcyNzA4ATiy&pd=2323UExJck1EIXDlUmNJ i==&campaignId=9jn0AznyOTcwAZMq (googlechromesetup.exe)

1 / 68 (PUP)

http://down-great.info/?dl=1&pi=Ajg4NzcRNzg0Ni==&osos=VdluDrW3cw==&dr=cHaWck13IKFC 32zUK1J2mllUK1PIdVyvExthXN3DKV0vENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1VLyDj rcWDK4m7z0RvmiWAkDjIKiWXzMROZ7dOTMFASDPDdlChV8FNjadOT73AZaz&pd=2323UmxJ2d4tcdWm2H2PcmLu7dWt&campaignId=9jn0Ajg3ATayAZMq (windowsmoviemakersetup.exe)

0 / 68

http://down-great.info/?dl=1&pi=ATa0NTA3NjAwNw==&osos=VdluDrW3cw==&chnl=b_sa_chwin8&dr=c3aW7mcm2r0Wc32lDXimcHaWck1zcrW0IKDFvmCWcyDEcmlChSDBDz1l QDj7z1ZiSDj rcWDK4m7z0RvmiWAkDjIKiWXzL3OT7dOTMFASDPDdlChV8zOT70NTc3AZaz&pd=2323UmxJ2dFB d5CDrW3 QFj d0=&campaignId=9jn0AzAFATMdAZMq (spotifysetup.exe)

1 / 68 (PUP)

http://down-great.info/?dl=1&pi=AjC1NZi4OTMzNg==&osos=VdluDrW3cw==&chnl=b_sa_chwin8&dr=cHaWck1Q HVlc3xP7dtzvExthXN3DKV0NkDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWx0am7dREhKVuvmAWASDChTMm7dlChV81NjL4NzgwOTnm7K2pDZ1fOZadNZi4ATa0Ag==&pd=2323Um5wcHAt mV3UmNJ i==&campaignId=9jn0AzaFOZL0AZMq (bluestackssetup.exe)

1 / 68 (PUP)

http://down-great.info/?dl=1&pi=OTC1Nzn3ATLw&osos=VdluDrW3cw==&dr=c3aW7mcm2r0Wc32lDXimcHaWck10DK5t2mll2dVyvmCWcyDEcmlChSDBDz1l QDj7z1vTQDj rcWDK4m7z0RvmiWAkDjIKiWXzM1NziFOZMFASDPDdlChV8ROZcRNzazAjiy&pd=2323UmDyDKVBDK2l mxPcECu7dWt&campaignId=9jn0AznwNTL4AZMq (teamviewersetup.exe)

1 / 68 (PUP)

http://down-great.info/?dl=1&pi=ATa0OZcRAZi0AM==&osos=VdluDrW3cw==&chnl=b_sa_ch&dr=cHaWck13IKFy7Xam2r0Wc32lDXiyvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1VLyDj rcWDK4m7z0RvmiWAkDjIKiWXz7ROT7dOTMFASDPDdlChV81Aza4Azc3AZaz&pd=2323Um5wcHAtDdV0UmNJ i==&campaignId=9jn0AziwAzAwAZMq (winrarsetup.exe)

1 / 68 (Adware)

http://down-great.info/?dl=1&pi=OZA4ATL3NTid&osos=VdluDrW3cw==&dr=cHaWck1jIHvJ KLm2r0Wc32lDXiyvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1TxyDj rcWDK4m7z0RvmiWAkDjIKiWXzCRAzAzOZMFASDPDdlChV8dNjgyNzA4ATiy&pd=2323UExJck1EIXDlUmNJ i==&campaignId=9jn0Azn0Ajg0AZMq (googlechromesetup.exe)

1 / 68 (PUP)

http://down-great.info/?dl=1&pi=AzA4ATLwNZg4Ag==&osos=VdluDrW3cw==&chnl=b_sa_chwin8&dr=cHaWck1w 3sj 3vuUXxp KLm2r0Wc32lDXimc3aW7mcmIT1zvm2yIKiWvmREhKVuvmNjhL17vmNBDz1l QDjhTnmDZ0wvmNpDZ1fNT7zNjC4AZCRvm5EIKiWXzA4AzCzNTAyNZa=&pd=2323Um2JDd8t2XsB d5CUmNJ i==&campaignId=9jn0Aza0OZgdAZMq (popcorntimesetup.exe)

1 / 68 (PUP)

http://down-great.info/?dl=1&pi=ATn0NZA3AzgyAi==&osos=VdluDrW3cw==&dr=c3aW7mcm2r0Wc32lDXimcHaWck1zcrW0IKDFvmCWcyDEcmlChSDBDz1l QDj7z1VLyDj rcWDK4m7z0RvmiWAkDjIKiWXzg1OT7dOTMFASDPDdlChV8RAj7FAzc3AZaz&pd=2323UmxJ2dFB d5CDrW3 QFj d0=&campaignId=9jn0AznyAj74AZMq (spotifysetup.exe)

1 / 68 (PUP)

http://down-great.info/?dl=1&pi=Ajg4NzcRNZi1OM==&osos=VdluDrW3cw==&dr=cHaWck1tIKFl73vPDEim2r0Wc32lDXiyvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1HiQDj rcWDK4m7z0RvmiWAkDjIKiWXzMzATMzOZMFASDPDdlChV8wNjiyAja4ATiy&pd=2323UmRlDdVuDrVyeS1PcHszUmNJ i==&campaignId=9jn0AjCzNTAwAZMq (minecraftsetup.exe)

1 / 68 (Adware)

http://down-great.info/?dl=1&pi=AzMRNTnROTLyNi==&osos=VdluDrW3cw==&chnl=&dr=cHaWck13IKFC 32zUK1J2mllUK1PIdVyvExthXN3DKV0vENyhKvEvmCWcyDEcmlChSDBDz1w2kDj7z1kLQDj rcWcHim7z0RvmiWAkDjIKiWXza4Nz7dOTMFASDPDdlChV8dNZC3Nz73AZaz&pd=2323UmxJ2d4tcdWm2H2PcmLu7dWt&campaignId=9jn0AzaRAzM0AZMq (windowsmoviemakersetup.exe)

0 / 68

http://down-great.info/?dl=1&pi=ATM1NTcFNj7yNg==&osos=VdluDrW3cw==&chnl=b_sa_chwin8&dr=cHaWck1mIXvlDmW4vExthXN3DKV0AQDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWTCwm7dREhKVuvmAWASDChTMm7dlChV8dNZM4AzgwOTnm7K2pDZ1fNzL1NTiROTn0Ag==&pd=2323UEvP2rLt2XNlUmNJ i==&campaignId=9jn0AzLyNZgwAZMq (firefoxsetup.exe-setup.website)

1 / 68 (PUP)

http://down-great.info/?dl=1&pi=ATC3NzL1NT7ROi==&osos=VdluDrW3cw==&dr=c3aW7mcm2r0Wc32lDXimcHaWck10DK5t2mll2dVyvmCWcyDEcmlChSDBDz1l QDj7z1vTQDj rcWDK4m7z0RvmiWAkDjIKiWXzM1NziFOZMFASDPDdlChV81AzaRNzazAjiy&pd=2323UmDyDKVBDK2l mxPcECu7dWt&campaignId=9jn0AzMzOZC4AZMq (teamviewersetup.exe)

1 / 68 (PUP)

http://down-great.info/?dl=1&pi=ATc4Ajc1NjAdNg==&osos=VdluDrW3cw==&chnl=b_sa_chwin8&dr=cHaWck1z7K1z2KFEUKtpDXAm2r0Wc32lDXidvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1vTQDj rcWDK4m7z0RvmiWAkDjIKiWXz7wNZn1OTMFASDPDdlChV8wAzgFOZcdAZaz&pd=2323Um2J diteKVzUmNJ i==&campaignId=9jn0Aza0ATi4AZMq (samsungkiessetup.exe)

1 / 68 (PUP)

http://down-great.info/?dl=1&pi=AjCyNjLROZizNM==&osos=VdluDrW3cw==&dr=cHaWck1Q HVlc3xP7dtzvExthXN3DKV0NkDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWVVAm7dREhKVuvmAWASDChTMm7dlChV8FAzL4NzgwOTnm7K2pDZ1fATCdOTa4ATa0Ag==&pd=2323Um5wcHAt mV3UmNJ i==&campaignId=9jn0AznzNzadAZMq (bluestackssetup.exe)

1 / 68 (Adware)

http://down-great.info/?dl=1&pipi=Ajg4NzcRAzg0Aw==&osos=VdluDrW3cw==&dr=cHaWck1mIXvlDmW4vExthXN3DKV0OSDzcj1zcmAmIT1zvm2yIKiWvmREhKVuvmNjhLFIvmNBDz1l QDjhTnmDZ0wvmNpDZ1fAZCzAZA3ATgyvm5EIKiWXzM3AjM3NZg1Njny&pd=7KN0IXDlUKluc3xP rRzUEVzUmNJ i==&campaignId=9jn0AjcwOZLwAZMq (firefoxsetup.exe)

1 / 68 (PUP)

http://down-great.info/?dl=1&pi=AjiRAzMwNZaF&osos=VdluDrW3cw==&chnl=b_sa_ch&dr=c3aW7mcm2r0Wc32lDXimcHaWck1E dWE rLtDK5y2rgmIT1zvm2yIKiWvmREhKVuvmNjhLlOvmNBDz1l QDjhTnmDZ0wvmNpDZ1fNjcROZC4AZCRvm5EIKiWXzcRAzLzNzAyNZa=&pd=2323UENJDEx37XvlUK2l2kFj d0=&campaignId=9jn0AzidAZL0AZMq (googleearthsetup.exe)

1 / 68 (PUP)

http://down-great.info/?dl=1&pi=ATc4ATc3ATMFNg==&osos=VdluDrW3cw==&chnl=b_sa_ch&dr=cHaWck13IKFC 32zUK1J2mllUK1PIdVyvExthXN3DKV0vENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1vTQDj rcWDK4m7z0RvmiWAkDjIKiWXzMwOZ7dOTMFASDPDdlChV84NzndOZ73AZaz&pd=2323UmxJ2d4tcdWm2H2PcmLu7dWt&campaignId=9jn0AzayNTgyAZMq (windowsmoviemakersetup.exe)

1 / 68 (PUP)

http://down-great.info/?dl=1&pi=ATaFNTA1Nja3AM==&osos=VdluDrW3cw==&dr=c3aW7mcm2r0Wc32lDXimcHaWck1wIKNPcdnmIT1zvm2yIKiWvmREhKVuvmNjhVN5vmNBDz1l QDjhTnmDZ0wvmNpDZ1fAj7yNT7FAZCRvm5EIKiWXzMdAjMzNTcwAjA=&pd=2323UEVwUK2J diu7dWt&campaignId=9jn0AjC0NjidAZMq (picasasetup.exe)

1 / 68 (PUP)

http://down-great.info/?dl=1&pi=AT7dNziRAjawNi==&osos=VdluDrW3cw==&chnl=b_sa_chwin8&dr=cHaWck13IKFy7Xam2r0Wc32lDXiyvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1VLyDj rcWDK4m7z0RvmiWAkDjIKiWXz7ROT7dOTMFASDPDdlChV81Aza4Azc3AZaz&pd=2323Um5wcHAtDdV0UmNJ i==&campaignId=9jn0AzaFNZiwAZMq (winrarsetup.exe)

7 / 68 (PUP)

http://down-great.info/?dl=1&pi=OZiRAT7zNZ7F&osos=VdluDrW3cw==&chnl=b_sa_ch&dr=cHaWck1jIHvJ KLm2r0Wc32lDXiyvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1VLyDj rcWDK4m7z0RvmiWAkDjIKiWXzLwNjczOZMFASDPDdlChV8RNT7zAzMFATiy&pd=2323UExJck1EIXDlUmNJ i==&campaignId=9jn0Azi3AZadAZMq (googlechromesetup.exe)

8 / 68 (PUP)

http://down-great.info/?dl=1&pi=ATi1ATcyAZMRAi==&osos=VdluDrW3cw==&chnl=b_sa_chwin8&dr=cHaWck1jIHvJ KLm2r0Wc32lDXiyvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1HiQDj rcWDK4m7z0RvmiWAkDjIKiWXzMdAZMzOZMFASDPDdlChV81OZawAja4ATiy&pd=2323UExJck1EIXDlUmNJ i==&campaignId=9jn0AziyNjcwAZMq (googlechromesetup.exe)

Subdomains

May 18, 2016

usv.down-great.info

URL:

http://down-great.info/

Network:

Amazon Web Services (AWS), running an EC2 instance

Web server:

nginx/1.4.7

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.