home

download.file-mirror.org

Whois Privacy Protection Service, Inc.  (Proxy Registrant)

Domain Information

The domain download.file-mirror.org is registered by proxy through Name.com, LLC. The hosted servers are located in San Jose, California within the United States which resides on the SoftLayer Technologies Inc. network.
Registrar:
Name.com, LLC

Server location:
California, United States (US)

ASN:
AS36351 SOFTLAYER - SoftLayer Technologies Inc.,US

Root domain:
file-mirror.org

Whois:
2 file-mirror.org records

The domain download.file-mirror.org has been seen to resolve to the following 2 IP addresses.

50.97.235.139
50.97.235.139-static.reverse.softlayer.com
February 17, 2016

208.101.20.2
208.101.20.2-static.reverse.softlayer.com
November 10, 2014

File downloads found at URLs served by download.file-mirror.org.

1 / 68      (Adware)
http://download.file-mirror.org/process/.../wmm_new.php  (windows-movie-maker-new.exe)

0 / 68
http://download.file-mirror.org/process/.../wmm_21.php  (windows-movie-maker-21.exe)

2 / 68      (inconclusive)
http://download.file-mirror.org/process/.../wmm_new.php?EsetProtoscanCtx=99b6a50  (windows-movie-maker-new.exe)

2 / 68      (inconclusive)
http://download.file-mirror.org/process/.../wmm_new.php?EsetProtoscanCtx=2f5e0b8  (windows-movie-maker-new.exe)

1 / 68      (PUP)
http://download.file-mirror.org/process/.../chrome.php?source=optimizer  (chrome-setup.exe)

The following 2 files have been seen to comunicate with download.file-mirror.org in live environments.

TCP » 208.101.20.2:80
DonutLeadsService.exe (DonutLeadsService)

TCP » 208.101.20.2:80
ie-update.exe

URL:
http://download.file-mirror.org/

Web server:
Microsoft-IIS/8.5

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.