home

downprov1.thesoftwarenow.com

Whois Privacy Corp.

Domain Information

The domain downprov1.thesoftwarenow.com registered by Whois Privacy Corp. was initially registered in November of 2014 through TLD REGISTRAR SOLUTIONS LTD. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Singapore, Singapore within Singapore which resides on the CloudFlare, Inc. network. The domain uses the CloudFlare CDN, a distributed domain name server service which utilizes a number of reverse proxy IP Addresses (see below).
Registrar:
TLD REGISTRAR SOLUTIONS LTD

Server location:
Singapore, Singapore (SG)

Create date:
Saturday, November 15, 2014

Expires date:
Tuesday, November 15, 2016

Updated date:
Monday, November 9, 2015

ASN:
AS13335 CLOUDFLARENET - CloudFlare, Inc.,US

Root domain:
thesoftwarenow.com

Whois:
2 thesoftwarenow.com records

Scanner detections:
Detections  (90% detected)

Scan engine
Details
Detections

AVG
Generic, Win32/Blacked
100.00%

Malwarebytes
PUP.Optional.Amonetize, PUP.Optional.Bundle
88.89%

Trend Micro House Call
TROJ_GEN.R047H07AB15, Suspicious_GEN.F47V0112, TROJ_GE.28D9CDA2, TROJ_GEN.R047H07A815, TROJ_GEN.R047H07AA15, TROJ_GE.C5E2297B
88.89%

Kaspersky
not-a-virus:HEUR:AdWare.Win32.Amonetize, not-a-virus:AdWare.Win32.Amonetize
88.89%

Dr.Web
Trojan.Amonetize.353, Trojan.Adfltnet.71, infected with Trojan.Amonetize.353, Trojan.Amonetize.2503
88.89%

VIPRE Antivirus
Trojan.Win32.Generic.pak!cobra, Threat.4657539
88.89%

Avira AntiVirus
Adware/AgentCV.A.119, ADWARE/Adware.Gen4, ADWARE/AgentCV.A.119
88.89%

G Data
Trojan.Generic.12505922, Gen:Variant.Application.Bundler.Amonetize.21, NSIS.Application.Crypted, Win32.Application.Agent.RCEZAU
88.89%

McAfee
Artemis!05CDC37E6BF5, Artemis!89FFC7FAD162, Artemis!8F00B3F9F161, Artemis!4A4C20E46DB3, RDN/Generic PUP.x!cs3
88.89%

Clam AntiVirus
Win.Adware.Amonetize-511, Win.Adware.Amonetize-703
77.78%

Trend Micro
TROJ_GE.28D9CDA2, TROJ_GE.C5E2297B
77.78%

Panda Antivirus
Trj/CI.A, Generic Suspicious
66.67%

avast!
Win32:PUP-gen [PUP], Win32:Amonetize-HQ [PUP], Win32:Amonetize-KJ [PUP]
55.56%

Sophos
Generic PUA JA, Generic PUA IB, Generic PUA PC (PUA), Virus 'Mal/VMProtBad-A', Generic PUA KM
55.56%

Bitdefender
Trojan.Generic.12505922, Gen:Variant.Application.Bundler.Amonetize.21
44.44%

The domain downprov1.thesoftwarenow.com has been seen to resolve to the following 2 IP addresses.

104.28.6.55
May 4, 2015

104.28.7.55
May 4, 2015

File downloads found at URLs served by downprov1.thesoftwarenow.com.

0 / 68
http://downprov1.thesoftwarenow.com/p/.../Lotoman 2 0 Pelicula Completa Online Gratis_10924_i14128593_il345.exe  (ccfce9e5453f984372551e07569a3106)

13 / 68    (PUP)
http://downprov1.thesoftwarenow.com/p/.../bsnl teracom 3g data card driver_10924_i14213416_il345.exe  (a54c9d1e43ece60f96f26ca0cdc48fc3)

20 / 68    (PUP)
http://downprov1.thesoftwarenow.com/p/.../gas turbine theory solution manual_10924_i14092401_il345.exe  (964c05a0f0ce9261974eaa47aa15bf50)

6 / 68      (Malware)
http://downprov1.thesoftwarenow.com/p/.../max payne 2 crack file_10924_i14018963_il345.exe  (alz.big.hero.6.2014.dvdscr.x264.by.ansa.mkv_10924_i14018881_il345.exe)

24 / 68    (PUP)
http://downprov1.thesoftwarenow.com/p/.../Bokep Indo Terbaru 2014 3gp_10924_i14149573_il345.exe  (4a4c20e46db35ca7722ccfa3fc36cbfb)

25 / 68    (Adware)
http://downprov1.thesoftwarenow.com/links?version=1.1.8.22&campid=10924&instid[appname]=maingot abdominal surgery pdf_Downloader&instid[appsetupurl]=http://go.downloadboutique.com/getfast/download.cgi?9&ti1=1405000&ti2=0&ti3=DD1_2015-01-12T15:22:11.287783 00:00&instid[cmdline]=/S /PERFORMINSTALL /NORUN&instid[appimageurl]=http://download.downloadboutique.com/d1/logo150x150.png&prefix=maingot abdominal surgery pdf&instid[thankyoupage]=http://download.downloadboutique.com/.../thank_you.php?ti1=1405000&ti2=0&ti3=DD1_2015-01-12T15:22:11.287783 00:00&parameter=maingot abdominal surgery pdf&instid[interrupted]=http://download.downloadboutique.com/.../interrupted.php?ti1=1405000&ti2=0&ti3=DD1_2015-01-12T15:22:11.287783 00:00&parameter=maingot abdominal surgery pdf&ti1=1405000&ti2=0&ti3=DD1_2015-01-12T15:22:11.287783 00:00  (tomtom go live maps crack__10924_i1446465658_il349033.exe)

25 / 68    (Adware)
http://downprov1.thesoftwarenow.com/links?version=1.1.8.22&campid=10924&instid[appname]=logiciel gratuit pour lire fichier bin_Downloader&instid[appsetupurl]=http://go.downloadboutique.com/getfast/download.cgi?9&ti1=1405000&ti2=0&ti3=DD1_2015-01-12T12:24:43.395139 00:00&instid[cmdline]=/S /PERFORMINSTALL /NORUN&instid[appimageurl]=http://download.downloadboutique.com/d1/logo150x150.png&prefix=logiciel gratuit pour lire fichier bin&instid[thankyoupage]=http://download.downloadboutique.com/.../thank_you.php?ti1=1405000&ti2=0&ti3=DD1_2015-01-12T12:24:43.395139 00:00&parameter=logiciel gratuit pour lire fichier bin&instid[interrupted]=http://download.downloadboutique.com/.../interrupted.php?ti1=1405000&ti2=0&ti3=DD1_2015-01-12T12:24:43.395139 00:00&parameter=logiciel gratuit pour lire fichier bin&ti1=1405000&ti2=0&ti3=DD1_2015-01-12T12:24:43.395139 00:00  (tomtom go live maps crack__10924_i1446465658_il349033.exe)

21 / 68    (PUP)
http://downprov1.thesoftwarenow.com/p/.../The Garden of Words (2013) 1080p.rar_10924_i14066464_il345.exe  (tomtom go live maps crack_10924_i14082556_il345.exe)

18 / 68    (PUP)
http://downprov1.thesoftwarenow.com/p/.../Malwarebytes Anti Malware 2.0.4.1028 Premium Portable_10924_i14008767_il345.exe  (e0ad776e578d3c66c48e3612e13ea444)

20 / 68    (PUP)
http://downprov1.thesoftwarenow.com/p/.../ardisson_10924_i14209037_il345.exe  (35394526c40f4ef74a71a4c919f4d703)

21 / 68    (PUP)
http://downprov1.thesoftwarenow.com/p/.../tomtom go live maps crack_10924_i14082246_il345.exe  (tomtom go live maps crack_10924_i14082556_il345.exe)

20 / 68    (PUP)
http://downprov1.thesoftwarenow.com/p/.../TeenMarvel Lili And Melissa Shower Cream_10924_i14011435_il345.exe  (32fb4a13629957158fdb2b81bbb36ee4)

URL:
http://downprov1.thesoftwarenow.com/

SSL certificate subject:
CN=sni21142.cloudflaressl.com, OU=PositiveSSL Multi-Domain, OU=Domain Control Validated

SSL certificate issuer:
CN=COMODO ECC Domain Validation Secure Server CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Web server:
cloudflare-nginx

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.