download.downloadrockstar.com

WHOISGUARD, INC.  (Proxy Registrant)

Domain Information

The domain download.downloadrockstar.com is registered by proxy through ENOM, INC. and was originally registered in November of 2013. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in New York City, New York within the United States which resides on the Digital Ocean, Inc. network.
Registrar:
ENOM, INC.

Server location:
New York, United States (US)

Create date:
Friday, November 8, 2013

Expires date:
Sunday, November 8, 2015

Updated date:
Friday, October 10, 2014

ASN:
AS46652 SERVERSTACK-ASN - ServerStack, Inc.

Scanner detections:
Detections  (96% detected)

Scan engine
Details
Detections

Reason Heuristics
DownloadManager.AirSoftware.F, PUP.Installer.InstallManager.J, DownloadManager.Bundler.Air Software, PUP.Air Software.AirSoftw.Bundler (M), PUP.Air Software (M)
100.00%

Malwarebytes
PUP.Optional.AirInstaller, PUP.Optional.AirAdInstaller
90.91%

avast!
Win32:Dropper-gen [Drp], Win32:Installer-L [PUP], Adware-gen [Adw], Win32:Adware-gen [Adw], PUP-gen [PUP], Win32:Adware-BZI [PUP]
90.91%

Comodo Security
Application.Win32.AirAdInstaller.A, Application.Win32.AirAdInstaller.B, Application.Win32.AirInstaller.JSUE, Application.Win32.AirInstaller.CEBE
90.91%

Dr.Web
Trojan.SMSSend.5245, Adware.Downware.5906, Trojan.SMSSend.5379, Trojan.SMSSend.5270, Trojan.SMSSend.5375, Trojan.SMSSend.5348
90.91%

VIPRE Antivirus
Iminent, Threat.4150696, Trojan.Win32.Generic, Threat.5061940, Threat.4848734
90.91%

Sophos
AirInstaller, PUA.AirInstaller, PUA 'AirInstaller'
90.91%

ESET NOD32
Win32/AirAdInstaller.A potentially unwanted application
90.91%

Rising Antivirus
PE:PUF.Airinstall!1.9C4C
90.91%

Agnitum Outpost
PUA.AirAd, PUA.AirAdInstaller
90.91%

Avira AntiVirus
ADWARE/Adware.Gen, APPL/AirInstaller.F, Adware/AirInstaller.938392
90.91%

Vba32 AntiVirus
AdWare.AirAdInstaller.ajov
90.91%

AhnLab V3 Security
PUP/Win32.AirAdInstaller, PUP/Win32.Installer
90.91%

IKARUS anti.virus
Win32.AdWare, Win32.Malware, AdWare.SuspectCRC, not-a-virus:AdWare.AirAdInstaller, PUA.AirAdInstaller
90.91%

AVG
Generic_r, Adware BundleApp_r.AK, Adware InstallCore, Airsoftware
90.91%

The domain download.downloadrockstar.com has been seen to resolve to the following 4 IP addresses.

108.168.218.35-static.reverse.softlayer.com
December 1, 2014

justice.airinstaller.com
December 1, 2014

chicago.airinstaller.com
November 13, 2014

173.192.195.228-static.reverse.softlayer.com
September 3, 2014

File downloads found at URLs served by download.downloadrockstar.com.

The following file have been seen to comunicate with download.downloadrockstar.com in live environments.

URL:
http://download.downloadrockstar.com/

Title:
“Air Installer ™”

Description:
“Air Installer”

Web server:
Apache/2.2.22 (Ubuntu) (PHP/5.4.31-1+deb.sury.org~precise+1)

30 of 42 related domains