home

download.downloadster.org

Downloadster

Domain Information

downloadster distributes apps with its download manager which bundles adware toolbars such as Babylon and Rally as well as other potentially unwanted software. "We're able to offer free software because we are advertiser supported. When you download software, it gives our advertisers a chance to speak to you. ALL OFFERS ARE OPTIONAL. Users may be offered to change their browser homepage during install." This domain has been known to host and distribute potentially unwanted software. The hosted servers are located in Beaumaris, Victoria within Australia which resides on the Asia Pacific Network Information Centre network. The domain is associated with the publisher Downloadster who is located in SAN FRANCISCO, California in the United States.
Registrar:
Ulysses S. Grant, LLC

Server location:
Victoria, Australia (AU)

ASN:
AS133618 TRELLIAN-AS-AP Trellian Pty. Limited,AU

Root domain:
downloadster.org

Whois:
2 downloadster.org records

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Installer.DownloadAdmin.U, PUP.Installer.DownloadAdmin.O, PUP.Tightrope.DownloadAdmin.Bundler (M), PUP.Tightrope.Download.Bundler (M)
100.00%

Dr.Web
Adware.Downware.80
80.00%

VIPRE Antivirus
DownloadAdmin
80.00%

Avira AntiVirus
Adware/DownloadAd.CK
80.00%

Sophos
Download Admin
80.00%

SUPERAntiSpyware
Trojan.Agent/Gen-DownloadAdmin
80.00%

ESET NOD32
Win32/DownloadAdmin.A.Gen
80.00%

McAfee
Artemis!C3436D659AB7, Artemis!37B72C47A0D7
40.00%

K7 AntiVirus
Unwanted-Program
20.00%

Rising Antivirus
PE:Malware.XPACK/RDM!5.1
20.00%

Trend Micro House Call
TROJ_DOWNLOADADMIN_0000002.TOMA
20.00%

The domain download.downloadster.org has been seen to resolve to the following 4 IP addresses.

103.224.182.244
lb-182-244.above.com
April 16, 2016

184.168.221.37
ip-184-168-221-37.ip.secureserver.net
December 4, 2015

50.22.63.138
50.22.63.138-static.reverse.softlayer.com
May 15, 2015

50.22.63.140
50.22.63.140-static.reverse.softlayer.com
May 15, 2015

File downloads found at URLs served by download.downloadster.org.

10 / 68    (Adware)
http://download.downloadster.org/download?bc=134&aid=Google  (vlcmediaplayer-setup.exe)

7 / 68      (Adware)
http://download.downloadster.org/download?bc=233&aid=Google  (tidyview-setup.exe)

1 / 68      (Adware)
http://download.downloadster.org/download?bc=246&aid=Google  (tidyview-setup.exe)

9 / 68      (Adware)
http://download.downloadster.org/download?bc=134  (vlcmediaplayer-setup.exe)

7 / 68      (Adware)
http://download.downloadster.org/download?bc=146&aid=Google  (vlcmediaplayer-setup.exe)

The following 177 files have been seen to comunicate with download.downloadster.org in live environments.

TCP » 50.22.63.138:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 50.22.63.140:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 50.22.63.140:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 184.168.221.37:80
produpd.exe (produpd.exe by Vested Development, Inc)

TCP » 50.22.63.138:80
update_31.exe (Fast Downloader Media)

TCP » 50.22.63.140:80
windowssoftwareupdater.exe (SoftwareUpdater)

TCP » 50.22.63.138:80
updateadmin.exe

TCP » 50.22.63.138:80
windowssoftwareupdater.exe (SoftwareUpdater)

TCP » 50.22.63.140:80
updateadmin.exe

TCP » 50.22.63.140:80
update_31.exe (Fast Downloader Media)

TCP » 50.22.63.138:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 50.22.63.138:80
netdownloader.exe

TCP » 50.22.63.140:80
netdownloader.exe

TCP » 184.168.221.37:80
jingling.exe

TCP » 50.22.63.140:80
update_14.exe (Fast Downloader Media)

TCP » 50.22.63.140:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 50.22.63.138:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 50.22.63.138:80
update_14.exe (Fast Downloader Media)

TCP » 50.22.63.138:80
update_14.exe (Fast Downloader Media)

TCP » 50.22.63.138:80
update_14.exe (Fast Downloader Media)

 
Latest 20 of 216 files

URL:
http://download.downloadster.org/

Web server:
Apache (PHP/5.4.45-0+deb7u2)

adlogica.com

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.