home

get.downserver5.com

OutBrowse

Domain Information

The domain get.downserver5.com registered by OutBrowse was initially registered in April of 2014 through GODADDY.COM, LLC. This domain has been known to host and distribute adware as well as other potentially unwanted software. The domain uses the Amazon Web Services (AWS) cloud computing platform.
Registrar:
GODADDY.COM, LLC

Create date:
Sunday, April 20, 2014

Expires date:
Wednesday, April 20, 2016

Updated date:
Sunday, April 26, 2015

Root domain:
downserver5.com

Whois:
1 downserver5.com record

Google Safe Browsing:
malware

Scanner detections:
Detections  (67% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Outbrowse, PUP.OutBrowse (M), PUP.Outbrowse.StartPlaying.Bundler (M), PUP.Outbrowse.BonDoNjOv.Bundler (M), PUP.Outbrowse.BonDoNjO.Bundler (M), PUP.Outbrowse.StartPla.Bundler (M)
66.67%

ESET NOD32
Win32/OutBrowse.BU potentially unwanted application, Win32/OutBrowse.BZ potentially unwanted application
50.00%

McAfee
Program.Adware-OutBrowse.e, Program.Adware-OutBrowse.h, Trojan.Adware-OutBrowse.h, Trojan.Artemis!F390E1031DA7
50.00%

Dr.Web
infected with Trojan.OutBrowse.100, infected with Trojan.OutBrowse.1215, infected with Trojan.OutBrowse.1574, infected with Trojan.OutBrowse.1611
50.00%

Sophos
OutBrowse Revenyou, PUA 'OutBrowse Revenyou', Generic PUA BO (PUA), Generic PUA OB (PUA)
50.00%

VIPRE Antivirus
Threat.4150696, OutBrowse
41.67%

K7 AntiVirus
Trojan , Unwanted-Program
41.67%

Comodo Security
Application.Win32.AltBrowse.HY, Application.Win32.OutBrowse.AZ, ApplicUnwnt.Win32.OutBrowse.AM
41.67%

Avira AntiVirus
PUA/Outbrowse.Gen
41.67%

G Data
Gen:Variant.Application.Bundler.Outbrowse, Win32.Adware.Outbrowse, Win32.Application.OutBrowse.AQ
41.67%

Fortinet FortiGate
Riskware/OutBrowse, Adware/OutBrowse
41.67%

AVG
Downloader
41.67%

Kaspersky
not-a-virus:HEUR:AdWare.Win32.OutBrowse, not-a-virus:AdWare.Win32.OutBrowse
41.67%

Agnitum Outpost
PUA.OutBrowse
33.33%

Clam AntiVirus
Win.Adware.Outbrowse-1046, Win.Adware.Outbrowse-1128
33.33%

The domain get.downserver5.com has been seen to resolve to the following 19 IP addresses.

50.19.244.143
ec2-50-19-244-143.compute-1.amazonaws.com
April 17, 2016

54.225.72.141
ec2-54-225-72-141.compute-1.amazonaws.com
April 2, 2016

54.225.153.30
ec2-54-225-153-30.compute-1.amazonaws.com
February 29, 2016

107.20.138.96
ec2-107-20-138-96.compute-1.amazonaws.com
February 29, 2016

54.225.222.50
ec2-54-225-222-50.compute-1.amazonaws.com
February 10, 2016

23.23.109.139
ec2-23-23-109-139.compute-1.amazonaws.com
February 10, 2016

54.83.204.208
ec2-54-83-204-208.compute-1.amazonaws.com
December 5, 2015

54.235.141.90
ec2-54-235-141-90.compute-1.amazonaws.com
December 5, 2015

54.197.249.79
ec2-54-197-249-79.compute-1.amazonaws.com
December 5, 2015

54.235.139.218
ec2-54-235-139-218.compute-1.amazonaws.com
October 26, 2015

54.221.237.19
ec2-54-221-237-19.compute-1.amazonaws.com
October 26, 2015

107.20.176.109
ec2-107-20-176-109.compute-1.amazonaws.com
October 26, 2015

54.243.184.119
ec2-54-243-184-119.compute-1.amazonaws.com
October 26, 2015

50.16.189.166
ec2-50-16-189-166.compute-1.amazonaws.com
October 26, 2015

107.22.164.116
ec2-107-22-164-116.compute-1.amazonaws.com
October 26, 2015

23.21.67.254
ec2-23-21-67-254.compute-1.amazonaws.com
October 12, 2015

54.225.71.32
ec2-54-225-71-32.compute-1.amazonaws.com
October 12, 2015

23.21.212.252
ec2-23-21-212-252.compute-1.amazonaws.com
October 12, 2015

107.22.237.67
ec2-107-22-237-67.compute-1.amazonaws.com
May 5, 2015

File downloads found at URLs served by get.downserver5.com.

0 / 68
http://get.downserver5.com/.../1442096229/1442096229?33895888307ZGJsKS83aDUvMy0xNh5bOCoxLzMwH2k6KjArKCgeaz0qI21qZl9tW2xrYWZiOjxmcmZkZ15kHi8tRVhpWV9dbyZedWJtaWc1YGxxcB4wXh0pYR0qXm1mJ19iZmFcZWFmcHRrXmVrJV5nZR0vZmwiL14oLywqKDY2KzAuHSlhXWYdL2YxIi9eKiAqXjAwOSs2KjEpMSspJWppXG9sa2ZhbCVnY2ZiYGIlKSspKCZieF4jYXFlXGVhW2thZmI6RWBeamdrbGZtIi8oRmFeYVtiJSstLygoKx5eYWllZ15qXTRIYVtqbHNoY3EdKStHXl5mY14iLygpKykoHnA9XWx0ZmNqWVxrI2lcbGs1KiseaGppPSojYGdlOCkecmZwNjU  (microsoft office 2010.rar)

1 / 68      (Adware)
http://get.downserver5.com/.../1442597320/1442597320?05194504729Z2BzKTE6cG5lOygmazwqLC0yIl07KTQxLygiZz0tLzcrJmk8JyJfMTksMS42LzAdYC09KSokWzM4LCgiXzQ5Ji8dZDA8JC0hZmVlY2VhaGQ0b2B0cWkkWmxkYmJlXz1zQ0krQi1LRTBROTFFLy5OKzgwRjxNUT4kYGNqbTQvKyZsa2o0MSFiZmo4MQ  (setup.exe)

1 / 68      (Adware)
http://get.downserver5.com/.../1442597317/1442597317?67336196844YV5xLy8 Z2xkOS0gaTowKjEpIFw5Li4vLS4gazQrLjUwIGc6LSBjKDcrLzMwLS4jXjE0JykiYC02Ki4gYys3JS0iXi46KislXWNkYWpbZmI6bWRrb2giX2ZiYGhjYzRxQkcwPCtJSy5VMC9ELTNIKTY2REBETz0iZV1oazotLx1qamg5Kx9gbGg8KA  (setup.exe)

1 / 68      (Adware)
http://get.downserver5.com/1421802370/DownloadManager/getalgk5?p=1955&d=1782&l=1701&n=1&productname=Picasa&d1=140859&d2=145&exeurl=http://dl.google.com/picasa/picasa39-setup.exe&filename=Picasa&dynamicname=Picasa&tyurl=http://www.postdownload.net/.../redirect.php?id=6hdegs55u9fu5rs5urhlh7r88o3t4d5125j40n28anakbspdkg01-2364536a9c09d509516c07564b277969&d=downloadnet.org&p=Picasa&pid=3&bex=1&countryid=265  (picasa.exe)

1 / 68      (Adware)
http://get.downserver5.com/.../1442597113/1442597113?08528627486Z11vMC05bmtoNSsmaDgxKCwwH2A1LDAqNDUeZjsqMjEuJmY4Lh5eLzYtKSowKSFiKjcrKiJcLT0lLCRcLjsmLR5eNTUoLx5gZ2VhZlttXThxXW5zaSJbZmlbZmdcN3VDSktISEVQQUlJT0UtL0gwTj5QRklSRiJhXW9mODEoIG5raDUrJltqbDUr  (setup.exe)

0 / 68
http://get.downserver5.com//ff1k81k/14448004441/.../?34440520595ZGFwLjM6bj0tKC40LCJgPS01OSsnIWk5LjI0MzUmaTQrI2AtOTQuMDkrLSFhLjkpMSFiMzgkLCNgMDktLCRkMDQoLiJiZWxgbGFoXDhwYXBxcCFhbGRaZmZgOS01Lzc5LCgxMzUtMDQvNjArKy0zIm9xYmRiPS8qLTYsMiJzOHRvcVhhaV1ucXJgZSZkWmprOS8sJmtwbDgoIWBrajkxIXhpazQzI3BvOTEvMjQzJysxMDAiZ287Z2BrLTA  (setup.rar)

0 / 68
http://get.downserver5.com//14451149500/yo41v8v/096nnvk257/.../XGthIWBdbm41MSghbm5nNCslY2dsNSwkdmRnNzcmbHE1LDIwMCgrMzktLh5icjliXG4xMw  (undertale free download pc game.rar)

1 / 68      (Adware)
http://get.downserver5.com/.../1442604059/1442604059?99593940871XlxvKTI2bD0pLzcoKiFbOikwNC8pJWM0LSozLDQmZjYwHV1kY2JlXW1dNkNmbGc6ZlZSMyYqLScdZFpsZTkzKB9vaWM4KCNaa241Kg  (doulci_v3.1.0.exe)

0 / 68
http://get.downserver5.com/.../1444382780/1444382780?89011588811X1x0MTI6aDUqLzEtKSZjPC0uLjA0JWQ0MjQ3Mi8eZjwwHmdybmNwW2xmYGxdNFZLQiAqKEVkY2FYJTEvS2RZcWRxHSkwMS0sJi5ZJWNxZWFsaF5mWWVkPE5DQyQxK0VdXGhgHSkwT2tccV1qJDEoKS4wLTFZHl5oa11lYWxkOG5kWywxJiguNWAob2FmMjFrXHR0byFhW2dtPCsnJm9xZzUpHmJuZjQxJXlkaDUw  (vlc-2.1.6a-win32setup.rar)

1 / 68      (Adware)
http://get.downserver5.com/1421890167/DownloadManager/getalgk5?p=1955&d=3075&l=2937&n=1&productname=Googlechrome&d1=156141&d2=142&filename=Google-Chrome&tyurl=http://www.postdownload.net/.../redirect.php?id=e866ur6jo1hb4n9uns5l8hma8ga1kuvna8e8p6ngsbavh4nrgq51-5e8860df246e876f009b5b7880c493d6&d=downloadzone.org&p=Google Chrome&pid=3&bex=1&countryid=265  (google-chrome.exe)

0 / 68
http://get.downserver5.com//.../1444669477/1444669477?13665566170ZmJuLC46ajc1KzEwI143LS4rLTQfbDwvLC0uLCBoPComb29pXnBebmhgZmU8QWlxaWdpW2NGYW1eYV9tIV9yZG5yazpibm9rHy1gHjJlIixgcnJxKGxiY3FsbWlhbydubmhsamZuKF5qZx8xX01oYGxpbmpgbiQrMFNsaWZmZG4oZHFlJWFzaFxoY11tWm1kOkdjXm1pbW5fdCQvKk5qamZlaG0lMS0sKDApLSBlYmxka1tnYDhHY2Jrb3JsYG4gLSpObmhsamZuHy0rLCg0JzMlcDdHZF5saXJoZnMiLCpPamlmamJ0JC8qLCkwKC0lYmNuazctKyFqbGs2MSVgaWg4LCB0aGk9Nw  (microsoft toolkit 2.5.3.rar)

0 / 68
http://get.downserver5.com//.../1444670238/1444670238?30566967371ZGVvLC02ajYvLDIvNyFeNykzMDMpJWk9LTMqJyofazYwI3BtaV5sXW1rWmxiPUhORU0sJzInMiNlc19vaWY2IiszIjddT0xDHzBhH2N2blxnY1poWmpePEpURlAsJS8nMB9lZmxgaFtkXzZKTUpTMikvKCogXGliYmhpXzdpO3EtLTosMFRNXltnQ1pcR1VuLUhuYVxuRUZALFJhZmphTHNMVGl1VjUuXkhdTzB0MGJOSWtNSD9QSFBwbElpMTxsUHQmVyl0M3QzSklKSEpMa0hCVC1SZVtKLkxSVC1hK1BfXk5bUURxV1B0VFJEY0p2LCVwPS0rMi0sH2Zcbms9LiogZ2xlOiolYG9pNysddGJtNjc  (mtkv2.5.3.rar)

7 / 68      (PUP)
http://get.downserver5.com//1444676418/1444676418/.../aTkuKjA2JWQ1LjktLS0eZj0xOC4yNx9qOSkgcHFvXHFjbWpdZV89Q29vamxoXWBFW25gZ11uJl50YW1sbDxobHBwbCEvWR8yZSUqYndeXipZbGNnaW5hLmhuYx0sZnZlWiEyXy4sKS8xLzAsLTUqMy0qHzJlaGxwcB4vXR0sZiQyXnFuZWVpYW5lY2hZX2tsKl9nZyUxZlxrd2doa1lecyQyXlFIQV1fY1AxLTEtKmVxYSJcc25gbWFfblppYTUfMi9VQCEyKURdW2UlMTBLYXRubCJeY2xkbllpZTZRRFdCYWJrHmVjaGo5Kyomb3JkOTEfX2tmNzElemFsPTE  (uh_hack.rar)

18 / 68    (PUP)
http://get.downserver5.com//igfo1/14456433311/14456433314/14456433319/?31544603814ZGRvLi85cDoqMTUuNCFgOSw5MTAyImk8LTQzLjIjZjwtI29ta2BvY3FmYGliPD9rc2hsbFljSV5tXGNhbCZicGRxb2s4ZHBucCIrYCEvZSAuYltwbWtycF5zZF8uYGQxa2QxYmwpby8oYWpZeWtrYHJvKl1vah0xYmdxYCkzbzYtJXZla2Nqc28naTIwNSpid2AiYHNuXmVoX2tgaGE5RGFzWSQuLVFwanBjbWIdMSxCbXFlbmlual1tcCNlZGhhaGFqXTxmXnVcW25vbnFhbGFcZGlyZWxval1tcFxyYHBxaiZwNUtMXzM LkZcSDM M20uUl1HVWNnRGIyRlFOPkIyQlN3cS9tUW1hVnBwMU5SbWJAYyxgT3BkcT02NEJER2tWaTFMclZCanBPY0xTWi8/.../aWxNT09uRkNwbGhFVFE8QUh3QyszZV5SRF9qZVBZal5lZ29ibFVET2FRXlFdUS1cU1Q1QVBWMkJkdDlJUHZ5YU9Ibm4zQzhkU3dSYkUwTGBxblJhcGIqKiBpYGdtOTAvIWxuZj0uHmJrazwsInZjcDowJXBwPCwwMC82MSsyLy4lYnA5YWVxKjI  (java_runtime_enviroment_setup.rar)

17 / 68    (PUP)
http://get.downserver5.com//14453915260/lzi9/.../?21202544252ZWRyMjE6bDkwKzA3MyRkOy0yMzArJGo8MDU3LDAibDgvJG9wb2JwX3BsXGtjPEdmZ3NdbG5DX2FqQm91aWhrX19LX21fZ2NtImF2YHNwaztVUEdbQk1NXUFAUFJHQE5bQ1NDJGN3bl9oZV9sXGtjPEdmZ3NdbG4gMC5HX2NpIC4sQ2llZ21jJTArRWpxb19qa2NyJGFlaGNpX2tkOyUxXyEuLklnbHNjbmJqIS4uYHFmbm4lMCtfXXBfIzAvYW9iYG8hMCtlY21jcl9va24kZGFtbTszLiFsbmo4LyRibW47LCJ2Z2s7NiVyczssMDAzLjcvNDA2JGJwOWVgcjAy  (nintendo eshop card codes generator.rar)

22 / 68    (PUP)
http://get.downserver5.com/1442141238/.../1442141238?64117404710YWFzMS07cDkqNTUqMiVjNi40MDAvJmY5MTIvMTgiZzwxIGJoa15qYWlePERpcWtiYltBX21odltwbnFYcjIqKV53Y2pjbnBvJmVcbm43Ly8laW5sOSolY2lqPDAfdmlsNjc  (doulci_activator_v2.0_windows.rar)

20 / 68    (PUP)
http://get.downserver5.com/1442216713/.../1442216713?35536726393ZGBvLy44bjcuLDExMSFhNys3Li0qI2k4LTUwLjcgazQuI2FkaV9nX2diNFFeZEJccCssLisqI2Zeams3LC4gbWlpOiwhYGlnOysjcWZtODM  (taig_v2.4.3.rar)

22 / 68    (Adware)
http://get.downserver5.com/.../get50?p=5654&d=8701&l=8181&n=1&productname=perfect parkjet system&dynamicname=perfect parkjet system&filename=perfect parkjet system&d1=1405000&d2=1&d3=1&icon=2  (perfect parkjet system.exe)

The following file have been seen to comunicate with get.downserver5.com in live environments.

TCP » 54.235.139.218:443
online-guardian-v2.0.9.exe

URL:
http://get.downserver5.com/

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
Microsoft-IIS/8.0 (ASP.NET) (Version: 4.0.30319)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.