» download.installs.co
Overview
Analysis
IPs Addresses (5)
Downloads (22)
Network (19)
Website Detail

download.installs.co

NameFind LLC

Domain Information

The domain download.installs.co registered by NameFind LLC was initially registered in November of 2013 through GODADDY.COM, INC.. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in New York City, New York within the United States which resides on the Digital Ocean, Inc. network.

Registrant:

NameFind LLC

Registrar:

GODADDY.COM, INC.

Server location:

New York, United States (US)

Create date:

Tuesday, November 5, 2013

Expires date:

Friday, November 4, 2016

Updated date:

Thursday, April 7, 2016

ASN:

AS393406 DIGITALOCEAN-ASN-NY3 - Digital Ocean, Inc.,US

Root domain:

Whois:

5 installs.co records

Scanner detections:

Detections (100% detected)

Scan engine

Details

Detections

Reason Heuristics

PUP.Installer.DownloadAssistant.N, PUP.Installer.DownloadAssistant.U, PUP.Installer.DownloadAssistant.H, PUP.DownloadAssistant.K, PUP.Installer.Air Software, PUP.Air Software, PUP.Bundler.Air Software, PUP.Air Software.DownloadAssistant.Bundler (M), PUP.Vittalia.InstallHelper (M), PUP.Air Software.Download.Bundler (M), PUP.Vittalia.InstallH (M), PUP.Air Software (M)

100.00%

Malwarebytes

PUP.Optional.DownloadAssistant

54.55%

VIPRE Antivirus

Threat.4782985, Threat.4150696

54.55%

AVG

Generic

50.00%

K7 AntiVirus

Unwanted-Program

45.45%

ESET NOD32

Win32/DownloadAssistant.A potentially unwanted application

45.45%

G Data

Win32.Application.DownloadAssistant, Gen:Variant.Application.Bundler.32, Gen:Variant.Symmi.49704, Application.Bundler.FX

45.45%

Emsisoft Anti-Malware

Gen:Variant.Application.Bundler.32, Gen:Variant.Symmi.49704, Application.Bundler.FX

40.91%

MicroWorld eScan

Gen:Variant.Application.Bundler.32, Gen:Variant.Symmi.49704, Gen:Variant.Graftor.171462, Application.Bundler.FX

40.91%

Bitdefender

Gen:Variant.Application.Bundler.32, Gen:Variant.Symmi.49704, Application.Bundler.FX, Gen:Variant.Graftor.171462

40.91%

Dr.Web

Adware.Conduit.170, Trojan.Vittalia.3, Trojan.Vittalia.34

36.36%

Avira AntiVirus

APPL/Downloader.Gen

36.36%

Panda Antivirus

Trj/Genetic.gen

36.36%

avast!

Win32:Adware-gen [Adw], Win32:Malware-gen, Win32:Adware-CKE [PUP], Win32:Adware-CKC [PUP]

31.82%

Agnitum Outpost

Riskware.Agent

31.82%

The domain download.installs.co has been seen to resolve to the following 5 IP addresses.

April 12, 2016

December 26, 2015

ec2-52-20-30-71.compute-1.amazonaws.com

November 18, 2015

ec2-54-208-156-227.compute-1.amazonaws.com

November 18, 2015

useast.gtdlrfwd.com

October 9, 2014

File downloads found at URLs served by download.installs.co.

1 / 68 (Adware)

http://download.installs.co/v2/click/9ks3c7y4/?d=http://downloadd.org/.../moviemaker.exe&n=Windows Live Movie Maker&key=4cfa3556034e55d726538ac43651819c4c320bd9e0e825cef3f03ab8a9673076&product_image=http://downloadd.org/.../moviemaker.png&sid=Windows Live Movie Maker&filename=Windows Live Movie Maker (Windows Live Movie Maker.exe)

1 / 68 (Adware)

http://download.installs.co/v2/click/9ks3c7y4/?d=http://downloadd.org/.../winrar.exe&n=WinRAR&key=651ac85b0cbac7398f59fa104d5c6b03e2a31ccd84932ba92ed07ca63f91736a&product_image=http://downloadd.org/.../winrar.png&sid=WinRAR&filename=WinRAR (cd8d2fa6b108e5cfdeb842b01535d86b)

1 / 68 (Adware)

http://download.installs.co/v2/click/9ks3c7y4/?d=http://downloadd.org/.../avast.exe&n=Avast Free Antivirus&key=a065adae87919abddacd1a4ae1d18fa109576ea2c7230c7ddde14ab6e1d3df77&product_image=http://downloadd.org/.../avast.png&sid=avast&filename=avast-free-antivirus (avast-free-antivirus.exe)

1 / 68 (Adware)

http://download.installs.co/v2/click/9ks3c7y4/?d=http://downloadd.org/.../moviemaker.exe&n=Windows Live Movie Maker&key=4cfa3556034e55d726538ac43651819c4c320bd9e0e825cef3f03ab8a9673076&product_image=http://downloadd.org/.../moviemaker.png&sid=Windows Live Movie Maker&filename=Windows Live Movie Maker (windows live movie maker.exe)

1 / 68 (Adware)

http://download.installs.co/v2/click/9ks3c7y4/?d=http://downloadd.org/.../moviemaker.exe&n=Windows Live Movie Maker&key=4cfa3556034e55d726538ac43651819c4c320bd9e0e825cef3f03ab8a9673076&product_image=http://downloadd.org/.../moviemaker.png&sid=Windows Live Movie Maker&filename=Windows Live Movie Maker (Windows Live Movie Maker.exe)

1 / 68 (Adware)

http://download.installs.co/v2/click/9ks3c7y4/?d=http://downloadd.org/.../moviemaker.exe&n=Windows Live Movie Maker&key=4cfa3556034e55d726538ac43651819c4c320bd9e0e825cef3f03ab8a9673076&product_image=http://downloadd.org/.../moviemaker.png&sid=Windows Live Movie Maker&filename=Windows Live Movie Maker (Windows Live Movie Maker.exe)

1 / 68 (Adware)

http://download.installs.co/v2/click/9ks3c7y4/?d=http://downloadd.org/.../moviemaker.exe&n=Windows Live Movie Maker&key=4cfa3556034e55d726538ac43651819c4c320bd9e0e825cef3f03ab8a9673076&product_image=http://downloadd.org/.../moviemaker.png&sid=Windows Live Movie Maker&filename=Windows Live Movie Maker (Windows Live Movie Maker.exe)

1 / 68 (Adware)

http://download.installs.co/v2/click/9ks3c7y4/?d=http://downloadd.org/.../moviemaker.exe&n=Windows Live Movie Maker&key=4cfa3556034e55d726538ac43651819c4c320bd9e0e825cef3f03ab8a9673076&product_image=http://downloadd.org/.../moviemaker.png&sid=Windows Live Movie Maker&filename=Windows Live Movie Maker (windows live movie maker.exe)

1 / 68 (Adware)

http://download.installs.co/v2/click/9ks3c7y4/?d=http://downloadd.org/.../moviemaker.exe&n=Windows Live Movie Maker&key=4cfa3556034e55d726538ac43651819c4c320bd9e0e825cef3f03ab8a9673076&product_image=http://downloadd.org/.../moviemaker.png&sid=Windows Live Movie Maker&filename=Windows Live Movie Maker (Windows Live Movie Maker.exe)

26 / 68 (Adware)

http://download.installs.co/v2/click/9ks3c7y4/?d=http://downloadd.org/.../moviemaker.exe&n=Windows Live Movie Maker&key=4cfa3556034e55d726538ac43651819c4c320bd9e0e825cef3f03ab8a9673076&product_image=http://downloadd.org/.../moviemaker.png&sid=Windows Live Movie Maker&filename=Windows Live Movie Maker (windows live movie maker.exe)

1 / 68 (Adware)

http://download.installs.co/v2/click/9ks3c7y4/?d=http://downloadd.org/.../internetexplorer10.exe&n=Internet Explorer&key=42a90a6a8f5923e92388c55f9ad6590025f61766fdc967595f1440377b164724&product_image=http://downloadd.org/.../internetexplorer10.png&sid=Internet Explorer&filename=Internet Explorer (internet explorer.exe)

26 / 68 (Adware)

http://download.installs.co/v2/click/9ks3c7y4/?d=http://downloadd.org/.../moviemaker.exe&n=Windows Live Movie Maker&key=4cfa3556034e55d726538ac43651819c4c320bd9e0e825cef3f03ab8a9673076&product_image=http://downloadd.org/.../moviemaker.png&sid=Windows Live Movie Maker&filename=Windows Live Movie Maker (windows live movie maker.exe)

26 / 68 (Adware)

http://download.installs.co/v2/click/9ks3c7y4/?d=http://downloadd.org/.../moviemaker.exe&n=Windows Live Movie Maker&key=4cfa3556034e55d726538ac43651819c4c320bd9e0e825cef3f03ab8a9673076&product_image=http://downloadd.org/.../moviemaker.png&sid=Windows Live Movie Maker&filename=Windows Live Movie Maker (windows live movie maker.exe)

23 / 68 (Adware)

http://download.installs.co/v2/click/9ks3c7y4/?d=http://downloadd.org/.../moviemaker.exe&n=Windows Live Movie Maker&key=4cfa3556034e55d726538ac43651819c4c320bd9e0e825cef3f03ab8a9673076&product_image=http://downloadd.org/.../moviemaker.png&sid=Windows Live Movie Maker&filename=Windows Live Movie Maker (Windows Live Movie Maker.exe)

23 / 68 (Adware)

http://download.installs.co/v2/click/9ks3c7y4/?d=http://downloadd.org/.../moviemaker.exe&n=Windows Live Movie Maker&key=4cfa3556034e55d726538ac43651819c4c320bd9e0e825cef3f03ab8a9673076&product_image=http://downloadd.org/.../moviemaker.png&sid=Windows Live Movie Maker&filename=Windows Live Movie Maker (Windows Live Movie Maker.exe)

16 / 68 (Adware)

http://download.installs.co/v2/click/9ks3c7y4/?d=http://downloadd.org/.../chrome.exe&n=Google Chrome&key=f96b7768c67bc1a082388f8b7616fa238c87b1ad7bfb53f8b4c1cd89c50ebad1&product_image=http://downloadd.org/.../chrome.png&sid=Google Chrome&filename=Google Chrome (Google Chrome.exe)

24 / 68 (Adware)

http://download.installs.co/v2/click/9ks3c7y4/?d=http://downloadd.org/.../chrome.exe&n=Google Chrome&key=f96b7768c67bc1a082388f8b7616fa238c87b1ad7bfb53f8b4c1cd89c50ebad1&product_image=http://downloadd.org/.../chrome.png&sid=Google Chrome&filename=Google Chrome (google chrome.exe)

14 / 68 (Adware)

http://download.installs.co/v2/click/9ks3c7y4/?d=http://downloadd.org/.../quicktime.exe&n=QuickTime&key=17407f95cf6766851c77d482054da05eba366fe7ab60be93bd194251fc0b5f98&product_image=http://downloadd.org/.../quicktime.png&sid=QuickTime&filename=QuickTime (c74d519edbdb882542f3a99bbce5db0a)

13 / 68 (Adware)

http://download.installs.co/v2/click/9ks3c7y4/?d=http://downloadd.org/.../teamviewer.exe&n=TeamViewer&key=c64d5bfd2c9d0e72e0e2c29c9b983b17365a7acee344a679c7dcc9102f19fd23&product_image=http://downloadd.org/.../teamviewer.png&sid=teamviewer&filename=teamviewer (587a743932ba93c7da276aa55accb873)

11 / 68 (Adware)

http://download.installs.co/v2/click/9ks3c7y4/?d=http://downloadd.org/.../firefox.exe&n=Mozilla Firefox&key=f806e16416f778679657bfb3f951df5e376a4d273eef706f1f804697ae2c913b&product_image=http://downloadd.org/.../firefox.png&sid=firefox&filename=Firefox (25a25cf3572bf85fdc069474598d1e81)

9 / 68 (Adware)

http://download.installs.co/v2/click/9ks3c7y4/?d=http://downloadd.org/.../windowsmediaplayer.exe&n=Windows Media Player&key=5e8cdfc9495ae370e63c65bd1fc41c5065188d83cf9db7f382bef8adc624b5bb&product_image=http://downloadd.org/.../windowsmediaplayer.png&sid=Windows Media Player&filename=Windows Media Player (windows media player.exe)

7 / 68 (Adware)

http://download.installs.co/v2/click/9ks3c7y4/?d=http://downloadd.org/.../chrome.exe&n=Google Chrome&key=f96b7768c67bc1a082388f8b7616fa238c87b1ad7bfb53f8b4c1cd89c50ebad1&product_image=http://downloadd.org/.../chrome.png&sid=Google Chrome&filename=Google Chrome (google chrome.exe)

The following 19 files have been seen to comunicate with download.installs.co in live environments.

TCP » 104.131.2.201:80

setup.exe (Google Chrome by Download Assistant)

TCP » 104.131.2.201:80

setup.exe (DVD Shrink by Download Publisher)

TCP » 104.131.2.201:80

setup.exe (Java Runtime by Download Assistant)

TCP » 104.131.2.201:80

setup.exe (WinZip by Download Assistant)

TCP » 104.131.2.201:80

Microsoft_Security_Essentials_Setup.exe (Microsoft Security Essentials by Download Assistant)

TCP » 104.131.2.201:80

Setup.exe (Java Runtime by Download Manager)

TCP » 104.131.2.201:80

Avast_Setup_2015.exe (Avast by Download Assistant)

TCP » 104.131.2.201:80

googlechromeupdatesetup.exe (Google Chrome by Install Helper)

TCP » 104.131.2.201:80

setup_adobe_reader.exe (Adobe Reader by Install Helper)

TCP » 104.131.2.201:80

AdobeReaderSetup-22796854.exe (Adobe Reader by Install Helper)

TCP » 104.131.2.201:80

chrome_installer.exe (Google Chrome Browser by DownloadAsst_New)

TCP » 104.131.2.201:80

microsoftsilverlightupdatesetup.exe (Microsoft Silverlight by Download Assistant)

TCP » 104.131.2.201:80

Firefox Setup.exe (Firefox by Install Assistant)

TCP » 104.131.2.201:80

malwarebytes anti-malware setup.exe (Malwarebytes Anti-Malware by Download Assistant)

TCP » 141.8.224.239:80

TCP » 141.8.224.239:443

TCP » 208.73.211.70:80

videostream-elfana.crx

TCP » 208.73.211.70:443

TCP » 208.73.211.70:443

URL:

http://download.installs.co/

Title:

“installs.co”

Title (10/9/2014):

“Welcome to nginx!”

Title (8/28/2015):

“installs.co - domain expired”

Web server:

Apache

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.