» files.downloadwiz.com
Overview
Analysis
IPs Addresses (4)
Downloads (22)
Network (1)
Related Domains (15)

files.downloadwiz.com

Air Software (via a Proxy Registrant)

Domain Information

The domain files.downloadwiz.com is registered by proxy through ENOM, INC. and was originally registered in September of 2004. This domain has been known to host and distribute potentially unwanted software. The hosted servers are located in New York City, New York within the United States which resides on the Digital Ocean, Inc. network. The domain is associated with the publisher Air Software who is located in Victoria, British Columbia in Canada.

Registrant:

WHOISGUARD, INC. on behalf of Air Software

Registrar:

ENOM, INC.

Server location:

New York, United States (US)

Create date:

Monday, September 13, 2004

Expires date:

Tuesday, September 13, 2016

Updated date:

Saturday, December 19, 2015

ASN:

AS14061 DIGITALOCEAN-ASN - Digital Ocean, Inc.

Root domain:

downloadwiz.com

Whois:

3 downloadwiz.com records

Scanner detections:

Detections (91% detected)

Scan engine

Details

Detections

Reason Heuristics

PUP.Optional.Installer.LionSeaSoftwarecoltd.F, PUP.Installer.Mindadmedia.F, DownloadManager.AirSoftware.F, PUP.Air Software.AirSoftware.Bundler (M), PUP.Air Software.AirSoftw.Bundler (M)

100.00%

Malwarebytes

PUP.Optional.OutBrowse, PUP.Optional.AirInstaller

30.00%

Trend Micro House Call

TROJ_GEN.F47V1013, HV_ZYX_CA082EC9.TOMC

30.00%

Dr.Web

Adware.Downware.1676, Adware.Downware.665, Adware.Downware.897, Adware.Downware.10718, Adware.Downware.10027

30.00%

VIPRE Antivirus

OutBrowse, Threat.4782985

30.00%

Sophos

DomainIQ pay-per install, AirInstaller, PUA 'AirInstaller'

30.00%

Bkav FE

W32.Clod8ba.Trojan, W32.HfsAdware

25.00%

K7 AntiVirus

Unwanted-Program

25.00%

Agnitum Outpost

PUA.OutBrowse, PUA.AirAd

25.00%

F-Prot

W32/AirInstall.A7.gen, W32/AirInstall.A.gen

25.00%

ESET NOD32

Win32/AirAdInstaller.A potentially unwanted application

25.00%

Comodo Security

Application.Win32.AirAdInstaller.B

25.00%

Avira AntiVirus

Adware/AirAdInstaller.K.17, Adware/AirAdInstaller.F

25.00%

Rising Antivirus

PE:PUF.Airinstall!1.9C4C

25.00%

IKARUS anti.virus

AdWare.AirAdInstaller

25.00%

The domain files.downloadwiz.com has been seen to resolve to the following 4 IP addresses.

192.241.139.115

justice.airinstaller.com

May 4, 2015

184.154.116.114

chicago.airinstaller.com

November 17, 2014

192.241.237.97

uswestmeganode1.airinstaller.com

May 1, 2014

108.168.218.34

108.168.218.34-static.reverse.softlayer.com

February 6, 2014

File downloads found at URLs served by files.downloadwiz.com.

1 / 68 (Adware)

http://files.downloadwiz.com/get/click/.../?filename=PDF_setup (pdf_setup.exe)

1 / 68 (Adware)

http://files.downloadwiz.com/get/.../?sid=man3&b=154903c7&filename=Setup (setup.exe)

1 / 68 (Adware)

http://files.downloadwiz.com/get/.../?b=d36ecead&filename=Yahoo_Chat_Messenger (yahoo_chat_messenger.exe)

1 / 68 (Adware)

http://files.downloadwiz.com/get/click/.../?filename=Word_Free (word_free.exe)

1 / 68 (Adware)

http://files.downloadwiz.com/get/click/.../?filename=Flash_Setup (flash_setup.exe)

1 / 68 (Adware)

http://files.downloadwiz.com/.../click.php?sid=D&b=c6f0fccc&filename=Yahoo_setup (yahoo_setup.exe)

1 / 68 (Adware)

http://files.downloadwiz.com/get/click/.../?filename=Word_Free (word_free.exe)

1 / 68 (Adware)

http://files.downloadwiz.com/get/.../?sid=man3&b=154903c7&filename=Setup (setup.exe)

1 / 68 (Adware)

http://files.downloadwiz.com/get/.../?sid=D&b=06f6f57a&filename=MSN_setup (msn_setup.exe)

1 / 68 (Adware)

http://files.downloadwiz.com/get/click/.../?filename=Video_Setup (video_setup.exe)

1 / 68 (Adware)

http://files.downloadwiz.com/get/click/.../?filename=Video_Setup (video_setup.exe)

1 / 68 (Adware)

http://files.downloadwiz.com/get/click/.../?filename=Video_Setup (video_setup.exe)

1 / 68 (Adware)

http://files.downloadwiz.com/get/.../?sid=flsh_new_ac&b=9j4s9fj2&filename=Flash_setup (flash_setup.exe)

25 / 68 (Adware)

http://files.downloadwiz.com/get/.../?sid=man3&b=154903c7&filename=Setup (setup.exe)

24 / 68 (Adware)

http://files.downloadwiz.com/get/.../?sid=man3&b=154903c7&filename=Setup (setup.exe)

24 / 68 (Adware)

http://files.downloadwiz.com/get/.../?sid=man3&b=154903c7&filename=Setup (setup.exe)

24 / 68 (Adware)

http://files.downloadwiz.com/get/.../?sid=man3&b=154903c7&filename=Setup (setup.exe)

0 / 68

http://files.downloadwiz.com/get/.../?sid=man3&b=154903c7&filename=Setup (setup.exe)

0 / 68

http://files.downloadwiz.com/get/click/.../?sid=newm&filename=Setup (setup3.0.13.0.exe)

15 / 68 (Adware)

http://files.downloadwiz.com/get/.../?sid=man3&b=154903c7&filename=Setup (setup.exe)

1 / 68 (PUP)

http://files.downloadwiz.com/get/.../?sid=man3&b=154903c7&filename=Setup (setup.exe)

12 / 68 (Adware)

http://files.downloadwiz.com/get/click/.../?sid=newm&filename=Setup (setup.exe)

The following file have been seen to comunicate with files.downloadwiz.com in live environments.

TCP » 108.168.218.34:80

15ba9f94.exe (Google Talk by AirInstaller)

Related Domains

realfreedownloads.com

trustydownloads.com

software-updater.com

updaterspro.com

thanksfordownloading.com

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.