home

get.downserver4.com

OutBrowse

Domain Information

The domain get.downserver4.com registered by OutBrowse was initially registered in April of 2014 through GODADDY.COM, LLC. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Ashburn, Virginia within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform.
Registrar:
GODADDY.COM, LLC

Server location:
Virginia, United States (US)

Create date:
Sunday, April 20, 2014

Expires date:
Wednesday, April 20, 2016

Updated date:
Tuesday, June 16, 2015

ASN:
AS14618 AMAZON-AES - Amazon.com, Inc.,US

Root domain:
downserver4.com

Whois:
1 downserver4.com record

Scanner detections:
Detections  (87% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Outbrowse, PUP.Outbrowse.YeSApPS.Bundler (M), PUP.Outbrowse.SafeSoft.Bundler (M), PUP.Outbrowse (M)
66.67%

ESET NOD32
Win32/OutBrowse.BU potentially unwanted application, JS/TrojanDropper.Agent.NAE trojan, Detection.Undefined
33.33%

Dr.Web
infected with Trojan.OutBrowse.88, JS.DownLoader.417
33.33%

McAfee
Program.Adware-OutBrowse.e, Program.Adware-OutBrowse.g
26.67%

Kaspersky
not-a-virus:Downloader.NSIS.OutBrowse, not-a-virus:HEUR:AdWare.Win32.OutBrowse
26.67%

AVG
Potentially harmful program Downloader.DIN, Luhe.Fiha.A
26.67%

AhnLab V3 Security
PUP/Win32.OutBrowse
26.67%

Fortinet FortiGate
Riskware/OutBrowse
26.67%

VIPRE Antivirus
Threat.4823950, Threat.4150696
20.00%

Malwarebytes
PUP.Optional.OutBrowse.gen
20.00%

K7 AntiVirus
DoS-Trojan
20.00%

NANO AntiVirus
Trojan.Win32.OutBrowse.dnkyzt
20.00%

Trend Micro House Call
Suspici.B3BC0FA9
20.00%

Comodo Security
Application.Win32.AltBrowse.HY
20.00%

Avira AntiVirus
APPL/Outbrowse.Gen
20.00%

The domain get.downserver4.com has been seen to resolve to the following 13 IP addresses.

54.175.102.143
ec2-54-175-102-143.compute-1.amazonaws.com
May 19, 2016

107.20.138.96
ec2-107-20-138-96.compute-1.amazonaws.com
April 5, 2016

54.225.72.141
ec2-54-225-72-141.compute-1.amazonaws.com
April 5, 2016

54.225.181.46
ec2-54-225-181-46.compute-1.amazonaws.com
December 4, 2015

54.204.47.158
ec2-54-204-47-158.compute-1.amazonaws.com
December 4, 2015

184.73.222.37
ec2-184-73-222-37.compute-1.amazonaws.com
December 4, 2015

23.21.130.149
ec2-23-21-130-149.compute-1.amazonaws.com
July 2, 2015

184.73.175.120
ec2-184-73-175-120.compute-1.amazonaws.com
July 2, 2015

50.19.215.244
ec2-50-19-215-244.compute-1.amazonaws.com
July 2, 2015

23.21.47.184
ec2-23-21-47-184.compute-1.amazonaws.com
June 30, 2015

54.225.237.59
ec2-54-225-237-59.compute-1.amazonaws.com
June 30, 2015

54.83.12.60
ec2-54-83-12-60.compute-1.amazonaws.com
June 30, 2015

54.243.74.245
ec2-54-243-74-245.compute-1.amazonaws.com
June 28, 2015

File downloads found at URLs served by get.downserver4.com.

1 / 68      (Adware)
http://get.downserver4.com/.../1435317923/1435317923?27721934085ZV5tMDU2bTkxKDQyH107MDA2LjkeZzsqMi44KyNqPSkhbmtoYnRacWphZWA7OmdneVhrQG9vaWpoWmJMWGtdZ11tJF5xY3RpaTlobG9uHixfJCljITJeXGxic19tJWBrbR0tZF1odW1jbF1kXmRqXiozM1tib2tsam4eK2RHOyIuMDtKQj48IzEnUGF0bWssXnFjJVt2amFlZGFnWmtkNEFlYVpnbR4rLjEcLywmNSAwKUVtcVsiLjBnYSMrKUJkanFudVtvZ2hnIzEnQ3FsZCAwKU9jcWpma24dLS4eMGEkKS1Ab29pamhaYiQpLUhvbyAwKUxuZFoiLjBIPiMrKUVgZGJvJSorIzBcIzEnT110WUhfaR4wLxw0XyUqK0JocGxrZl5gJSorSmhwIzEnQmpkHS0uSTwjMSdEXW1dbiMrXCMxJ0lrclwgMCloZCQpLUBla29wblxyaGZrITIoQXNlZSMxJ1NhcmtkbWceMC8cNF8lKitCaHBsa2ZeYCUqK0pocCMxJ1BsZVsgMClJQSQpLUNhZWBxHisuJC5gITIoTV9tWktgZyIuMB0yYR4rLkNmdGpsZ1xiHisuS2Z0ITIoQGxdHjAvR0AhMihCX2ZecSVdZmhlZlxrXjZCaFhfaG8dLS4rHjAvHXF1dWpnO2Ftcm8cMF0lKmEjK191dm4rXWlmYl9mXnEtWmxpJks4MyspNyVgYGtuNTQ1H3NnbzQt  (diablo 2.exe)

1 / 68      (Adware)
http://get.downserver4.com/.../1433884552/1433884552?67932686013YV5rLy85aDcxMi0xLB1hOyswLzYyI2Y2KjAwLx5oPS8jXio0S1NHOj9SJWBmYlpoZ141SUUwLUtNWVBjZB5jY25rNywnI3hjaDcw  (setup.exe)

1 / 68      (Adware)
http://get.downserver4.com/.../1433884552/1433884552?67932686013YV5rLy85aDcxMi0xLB1hOyswLzYyI2Y2KjAwLx5oPS8jXio0S1NHOj9SJWBmYlpoZ141SUUwLUtNWVBjZB5jY25rNywnI3hjaDcw  (setup.exe)

1 / 68      (Adware)
http://get.downserver4.com/1433885055/1433885055/.../aTUrJzUxIl03LTkyKjMdaDotMio1NB9mNygibW5oXnFjbWZbZGE6PWdjdmFnPGluamlrWl5JYWdZYVxuI2FxX3FyZTVia3BtISxbITJfHSxdXWtlc1tqLlxnZxwuY2BocWpsaFleXWVpYSovMGRea2Vra20hK2BERB4qKjpLQUE8Hy4wTF1ubGwrYXFfImRyZltkZWBqWmdhPUFtaGBhTWtpHy4wPGpbWmdiYB4sLCUwWx8pLEFrcGhob1pcHyksSmVnYyEyKT9bZGFwISsqTEMfXmNjYWtdZl85SG5mY1xMbGweLCxDa1ldYmFhISsqITdcHSwnQGxzZ2ZrYV0dLCdJZmpiHy4wQFlnXG8iLilKPyZtcW9paDpkbW5sJSxZHyliIi5fcXN3J1ljZWNeaV5tKmNoZSBKOTY0MS1dZGceY1prazksKiJ6Ymg3Jw  (huniepop cracked download mini games pc.exe)

1 / 68      (Adware)
http://get.downserver4.com/.../1425779864/1425779864?91648540331XmRuMi86bD0uMC8uMiBgNS0wNi0uJWM8KzIxLyJuOi0lWzA3Sk1IPkVPI2JjaF1nYV85NW4uLzs2YS9nTSJpYGxtNDQgdmFrOTI  (setup.exe)

1 / 68      (Adware)
http://get.downserver4.com/.../1433886860/1433886860?21279673236ZWRyKyg5aTovMCo1MiRdNCsxMjQwIGo8MSwpLx9rOy0gYjA7R0xHO0JQI11qaGFkYF42cTcuKk11dWxlXR9mYWxoOzIuH3FjaTou  (setup.exe)

1 / 68      (Adware)
http://get.downserver4.com/1433878296/1433878296/1433878296?79780057004YFxtKjE/azYxMDUtHV01MTk0KzkmaDYoMig5NCFnPTEiaWloXHVjb2dhbWE2OGdhemFpPW93amVmWlxNYWlaZ2VuH1xxXXVyZzZodHBpHCxZJTJhHjJmXWdgc1luLl5obSUuX1tob25salpkZmVlXB4qZmhfXG9kYVwpHipmSD8eMjA/.../ZmsdMjBSYm5ka3BqHiowYWldJTIsSF1fYWNlICswJTNcHCsoS2xqZ2luY2xmX2wmdHRucmw5YWttaCUzXB4yZiErXXBvdy5cYm5nXWZcbCZjb2gfUz0xKycvHmljamc9MywfcWJoPTA  (dowload microsoft toolkit 2.5 final, activator for windows and office kloningsoft.exe)

9 / 68      (PUP)
http://get.downserver4.com/.../1433878325/1433878325?15055253693ZmB0LSw9azorJzYzIWQ4LDc0LzMdaTwsOSs0MiFrNygjb21vX3Bhb2tbZGI8PG5kdV9pQWlua2tqYV9IX2leYVxvJWB4YHBwZzpia3FvIDNcIDBhIixdXm1kelxpLF5sZxwvZV9vcmlqal5eXWZrYCUtYWZfYGlbYmItJS1hRj8iLCdATj9FPiAwK1Bfa3JvKWVzYCRfdmhYamheblxoYzgiLC4iMStkal5zaGJoaytzZHRnYCMtLR8pNCVhaWdgbFxqXzQiMTIlLStiamBvZGJtby5vZHJnYh8pLSQtNyFvd3BvZjRlc29wIC5fIC9gHC9lcndyKV9ka2FYamRuLl5qayFQNywvLzEmbDhCanRmZl5jIDIrSGdeb2lqbGVvJS0rUmpsZmJmcyAyKy0sMCIsJ0NoaWFnIDBeIiwnPmJvaXFccmpvHyktRWpyIC0uUmZoW2x2biUtK19pYR8pLU5hZmReYyFmXWZrPC4wIXVnazoq  (' document.title '.exe)

3 / 68      (Malware)
http://get.downserver4.com/1435755677/.../1435755677?81627323742X2RuLzI8bjoqLzAuNCBiNi42NjAsJGQ8KzYqLzcjZzkvHm9sbV1yYXFnXWtdPD5DTEhRRTpOQx0xKlE QFNPQlBXHTEqS0hLR1FITiMqL0pQSCIwLS4hMChKP1dAQkwjXXVsWWxjYWdea2I2QENLSk1GOk9DIissUT1CT1BCUVciKyxLR01DUkhPIy8pTFBHJCwuLiIwLURBVz9ESCRfZmpiZ11rXTw Q0xIUUU6TkMdMSpRPkBTT0JQVx0xKktIS0dRSE4jKi9KUEgiMC0uITAoSj9XQEJMI10tOyoxIGdcbGw6Ly4kcmhqOykjaHBeOS8  (deskshare security monitor pro 5 keygen.jse)

2 / 68      (Malware)
http://get.downserver4.com/1435606352/.../1435606352?76257340503YF9yLDI8bD0vMzMsIGI4KzIxMi0maTYsMjIqLiJuODEjTDdJSExNZWNqJS8pKy4pKSs0JmtybF1vYW9nXmllOEtKTEpnXmgiLjAsMCspKDZOXnFxcCFldV5vcGc2ZXB0ayUwWh8wYR4vYm9taWRiaF9nXGxoM2llZCddbWgeL2JLSFNNYl1tS1pxX2gpZXVeIGJ0Z15paV5uXmZfO0ZGUExpXm8iKyovKyctKjghZmZlX2xcZmI5S0hTTWJdbSArLS0wKTArMSBydG5vaD0haWBoaDs0MCN2aWs9LR9kcWA2Lg  (kmspico 10.0.8.jse)

1 / 68      (inconclusive)
http://get.downserver4.com/1435480792/1435480792/1435480792?00471809780Z2VwKzU3cDQqMDk0MCJdPCo1JzIqJmw9Li0xLzgdZzUxJnBuaGNtY2tnWW1lPUBodmZsZlpcJTIwSVptWWdcax5kMT0sH1I1d0taZVh2bGFYaDlBOis/XzQtYytCZHgkZ0tBeUhbWDRETEs6Tlh6MDQmVy1wUHBbS1VMW0NNX0dDMFJubG0zPHJSXztPQVlJRltGTENIQSxqUnFyaFBUbEhJRVBHX0JsSkJBTmZkO291dlFtT2lIPjpMVjZZc1tSXEpIW2tJVVNgPG08ZygmTUszSzM8RmplLExDSUVHXlJZKzApR0hVQjZTZThhYkU6QnNGRmg/.../cUYsb3cxN1JmWVJKSE5iY2Vmc1xlPHREbWlJYXFfU2tkNEgnHmV4ZXFrazVoa21oJTNhIStlHTJdWmhwc3NwWnNhYylfXDRzZTFebCZzKidZbWF6a2dgb3MlXGdtJTJiYm1rdFhlZF9mbF1sZ1dwY1pxZXJfLSxeaGxsYGFuLmV0XiVceWVaZWljbl1mZDVBW2haZSUyLD9rWXNfHiowUGxdcmRqJl1iZGVuYWlePFlkZltdX2ZsXWxnV3BjWnFlciZlXG5mPTAwHnppcDkpJWJzXDYp  (adobe_flash_player.jse)

1 / 68      (inconclusive)
http://get.downserver4.com/1435445424/.../1435445424?77763751889YF5tLDM4azwpKycwLB9eOisvNy8vHWU2LC0vLiFtNSgdXSo2SFJGPURKHlplYlxlZl04RG4pJ3FEa3FFbiFoW2dlNjIwIHdiazwoHmFsXjYr  (setup.jse)

23 / 68    (Adware)
http://get.downserver4.com//.../get67?p=19141&d=25269&l=24430&tyurl=&n=1&productname=Java&filename=Java&clickid=wHNDDNOKETO795RHGL8B9DF2  (java.exe)

15 / 68    (Adware)
http://get.downserver4.com/1422817014/get67?p=4363&d=25522&l=24711&n=1&productname=Setup&dynamicname=KMSPico 10.0.3&filename=KMSPico_10.0.3&tyurl=http://ppvline.com/.../Windows8.html&S=kmspico  (kmspico_10.0.3.exe)

15 / 68    (Adware)
http://get.downserver4.com/1422817423/get67?p=9056&d=25703&l=24889&n=1&productname=Setup&dynamicname=KMSPico 10.0.5&filename=KMSPico 10.0.5&tyurl=http://ppvline.com/activation/.../KMSPico.html  (kmspico 10.0.5.exe)

The following file have been seen to comunicate with get.downserver4.com in live environments.

TCP » 54.83.12.60:80
avwebgrd.exe (Avira Product Family by Avira Operations GmbH & Co. KG)

URL:
http://get.downserver4.com/

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
Microsoft-IIS/8.0 (ASP.NET) (Version: 4.0.30319)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.