home

great-free.org

Privacy Protection Service INC d/b/a PrivacyProtect.org  (Proxy Registrant)

Domain Information

The domain great-free.org is registered by proxy through PDR Ltd. d/b/a PublicDomainRegistry.com. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Ashburn, Virginia within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform.
Registrar:
PDR Ltd. d/b/a PublicDomainRegistry.com

Server location:
Virginia, United States (US)

ASN:
AS14618 AMAZON-AES - Amazon.com, Inc.,US

Whois:
2 great-free.org records

Scanner detections:
Detections  (91% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.installCore (M), PUP.NewMedia.Installer.New Media Holdings.Installer (M), PUP.InstallCore.Internet.Installer.Meta (M), PUP.NewMedia.Installer.installCore.Installer (M), PUP.InstallCore.S (M), PUP.NewMedia.NMH.installCore.Installer (M), PUP.InstallCore.RES (M)
95.24%

VIPRE Antivirus
Threat.4150696, Threat.4786018
9.52%

ESET NOD32
Win32/InstallCore.AAE potentially unwanted application, Win32/InstallCore.XD potentially unwanted application
9.52%

Malwarebytes
PUP.Optional.InstallCore.A
9.52%

K7 AntiVirus
Adware , Unwanted-Program
9.52%

G Data
Win32.Application.InstallCore.EG, Win32.Application.InstallCore.CZ
9.52%

Vba32 AntiVirus
Malware-Cryptor.InstallCore.gen
9.52%

Agnitum Outpost
PUA.InstallCore
4.76%

Dr.Web
Trojan.InstallCore.33
4.76%

Sophos
PUA 'Install Core Click run software'
4.76%

Bkav FE
W32.HfsAdware
4.76%

NANO AntiVirus
Riskware.Win32.InstallCore.drfvvg
4.76%

Avira AntiVirus
ADWARE/InstallCo.zkt
4.76%

AVG
Generic
4.76%

The domain great-free.org has been seen to resolve to the following 3 IP addresses.

54.84.143.69
ec2-54-84-143-69.compute-1.amazonaws.com
July 1, 2015

52.7.132.182
ec2-52-7-132-182.compute-1.amazonaws.com
July 1, 2015

107.23.203.23
ec2-107-23-203-23.compute-1.amazonaws.com
July 1, 2015

File downloads found at URLs served by great-free.org.

1 / 68      (PUP)
http://great-free.org/?dl=1&pi=Ajg4NzcyNZgdNw==&osos=VdluDrW3cw==&dr=cHaWck1mIXvlDmW4vExthXN3DKV0AQDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWL0cm7dREhKVuvmAWASDChTMm7dlChV8zAzM4AzgwOTnm7K2pDZ1fOTC3NjiROTn0Ag==&pd=2323UEvP2rLt2XNlUmNJ i==&campaignId=9jn0AjgyATcyAZMq  (firefoxsetup.exe)

1 / 68      (PUP)
http://great-free.org/?dl=1&pi=Ajg4NzcyAj7yAM==&osos=VdluDrW3cw==&dr=cHaWck1TcHlQ 3im2r0Wc32lDXidvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1rLQDj rcWDK4m7z0RvmiWAkDjIKiWXzA4OTLwAZnFASDPDdlChV83AzA0OTg0ATaz&pd=2323Um5wcHAtc32lDXiu7dWt&campaignId=9jn0AjgzNTM0AZMq  (spybotsetup.exe)

7 / 68      (PUP)
http://great-free.org/?dl=1&pi=ATA0NZCRNZn0Oi==&osos=VdluDrW3cw==&chnl=b_sa_chwin8&dr=cHaWck13IKFC 32zUK1J2mllUK1PIdVyvExthXN3DKV0AQDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWx0am7dREhKVuvmAWASDChTMm7dlChV84AjgdNjCwOTnm7K2pDZ1fAjC3NzM3NzMyAw==&pd=2323UmxJ2d4tcdWm2H2PcmLu7dWt&campaignId=9jn0AziFATgdAZMq  (windowsmoviemakersetup.exe)

1 / 68      (PUP)
http://great-free.org/?dl=1&pi=ATL0NZc0OTM1Aw==&osos=VdluDrW3cw==&chnl=b_sa_chwin8&dr=cHaWck1PDH2j rVP mVyvExthXN3DKV0NQDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWx0am7dREhKVuvmAWASDChTMm7dlChV8dOTLFOZCwOTnm7K2pDZ1fNzCFAznzAjnyAw==&pd=2323Um5wcHNGIKFCUmNJ i==&campaignId=9jn0Azi1NZ7wAZMq  (adwcleanersetup.exe)

1 / 68      (PUP)
http://great-free.org/?dl=1&pi=OZiwATcFNTC=&osos=VdluDrW3cw==&chnl=b_sa_ch&dr=cHaWck1z7K1z2KFEUKtpDXAm2r0Wc32lDXiFvENyhKvEvmCWcyDEcmlChSDBDz1p2kDj7z1vVkDj rcWIXim7z0RvmiWAkDjIKiWXzC0OZadAZnFASDPDdlChV8wAj7dOTcFATaz&pd=2323Um2J diteKVzUmNJ i==&campaignId=9jn0AzaFAZi0AZMq  (samsungkiessetup.exe)

1 / 68      (Adware)
http://great-free.org/?dl=1&pi=ATL0OTcFNZ74Ni==&osos=VdluDrW3cw==&chnl=b_sa_sign_win8&dr=cHaWck13IKFC 32zUK1J2mllUK1PIdVyvExthXN3DKV0vENyhKvEvmCWcyDEcmlChSDBDz1mcQDj7z1rLQDj rcWDEam7z0RvmiWAkDjIKiWXzgROZ7dOTMFASDPDdlChV8zOZn1AZc3AZaz&pd=2323UmxJ2d4tcdWm2H2PcmLu7dWt&campaignId=9jn0Aza3Aji0AZMq  (WindowsMovieMakerSetup.exe)

1 / 68      (PUP)
http://great-free.org/?dl=1&pi=AjCdNTawNTCRAM==&osos=VdluDrW3cw==&chnl=b_sa_chwin8&dr=cHaWck1E dWE rLtDK5y2rgm2r0Wc32lDXi1vENyhKvEvmCWcyDEcmlChSDBDz1mcQDj7z1rLQDj rcWDEam7z0RvmiWAkDjIKiWXzLdAZazOTMFASDPDdlChV8wAzawNTC0AZaz&pd=2323UENJDEx37XvlUK2l2kFj d0=&campaignId=9jn0Azi4AjLwAZMq  (googleearthsetup.exe)

1 / 68      (Adware)
http://great-free.org/?dl=1&pi=ATLzAT7wNzL4Ag==&osos=VdluDrW3cw==&chnl=b_sa_sign_win8&dr=cHaWck1jIHvJ KLm2r0Wc32lDXiyvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1sxSDj rcWDK4m7z0RvmiWAkDjIKiWXzLFAjAzOZMFASDPDdlChV80AjayNzA4ATiy&pd=2323UExJck1EIXDlUmNJ i==&campaignId=9jn0Azi1AjgwAZMq  (googlechromesetup.exe)

1 / 68      (PUP)
http://great-free.org/?dl=1&pi=Ajg4NzcRNTCdNw==&osos=VdluDrW3cw==&dr=cHaWck1C2mit7dit7EVy mVyvExthXN3DKV0NQDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWLngm7dREhKVuvmAWASDChTMm7dlChV83AjgROTCwOTnm7K2pDZ1fNZLdNTn1AjnyAw==&pd=2323Um2yDK50UXsjUmNJ i==&campaignId=9jn0AjgFATc0AZMq  (pdvdcdburnersetup.exe)

1 / 68      (PUP)
http://great-free.org/?dl=1&pi=ATAROTMFNzc3Oi==&osos=VdluDrW3cw==&dr=cHaWck13IKFC 32zUK1J2mllUK1PIdVyvExthXN3DKV0vENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1vVkDj rcWDK4m7z0RvmiWAkDjIKiWXzMFNz7dOTMFASDPDdlChV8RNTC3Nz73AZaz&pd=2323UmxJ2d4tcdWm2H2PcmLu7dWt&campaignId=9jn0Azn0NZgyAZMq  (windowsmoviemakersetup.exe)

0 / 68
http://great-free.org/?dl=1&pi=AzndAzA4OZLzNw==&osos=VdluDrW3cw==&chnl=b_sa_ch&dr=c3aW7mcm2r0Wc32lDXimcHaWck1dIXv02K5BUKxqvmCWcyDEcmlChSDBDz1l QDj7z1vxSDj rcWDK4m7z0RvmiWAkDjIKiWXzg0NjcdOTMFASDPDdlChV8dNTgdATC3AZaz&pd=2323UEsJck1P73xp2mLu7dWt&campaignId=9jn0AzLRNzCdAZMq  (2365187_stp.exe)

1 / 68      (PUP)
http://great-free.org/?dl=1&pi=ATM0AzC1NZM0Oi==&osos=VdluDrW3cw==&chnl=b_sa_ch&dr=cHaWck10 d10 d0tIrWtDSD0 T1z2dVl2kDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWxVAm7dREhKVuvmAWASDChTMm7dlChV8RNTL3NjCwOTnm7K2pDZ1fNTcyAj74NzMyAw==&pd=2323UmRp2mLtcrWwUmNJ i==&campaignId=9jn0AzizOTAwAZMq  (tomtomhomesetup.exe)

1 / 68      (PUP)
http://great-free.org/?dl=1&pi=ATL0NTa0OZLyAg==&osos=VdluDrW3cw==&chnl=b_sa_ch&dr=cHaWck1JcmlEIK4m2r0Wc32lDXiyvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1HiQDj rcWDK4m7z0RvmiWAkDjIKiWXzMwOZA3OTMFASDPDdlChV8dOZAyATiFAZaz&pd=2323Um5j7dVw2rVC2dWy riu7dWt&campaignId=9jn0Azi0NjAyAZMq  (originsetup.exe)

1 / 68      (PUP)
http://great-free.org/?dl=1&pipi=Ajg4NzcyAjn3NM==&osos=VdluDrW3cw==&dr=cHaWck1w r5u2HAt2EAtemWt7mllcyD0 T1z2dVl2Zimc3aW7mcmIT1zvm2yIKiWvmREhKVuvmNjhVVTvmNBDz1l QDjhTnmDZ0wvmNpDZ1fAZa1Nz7FAZCRvm5EIKiWXzMwOTndOZcwAjA=&pd=2323Um2J dxP73xp2mLu7dWt&campaignId=9jn0AjcwNjLyAZMq  (plantsvszombiessetup.exe)

1 / 68      (Adware)
http://great-free.org/?dl=1&pi=Ajg4NzcyAZC1Ni==&osos=VdluDrW3cw==&dr=cHaWck1jIHvJ KLm2r0Wc32lDXiyvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1TxyDj rcWDK4m7z0RvmiWAkDjIKiWXzg4AjAzOZMFASDPDdlChV8dAZMyNzA4ATiy&pd=2323UExJck1EIXDlUmNJ i==&campaignId=9jn0AjCwATnwAZMq  (googlechromesetup.exe)

1 / 68      (PUP)
http://great-free.org/?dl=1&pi=ATAFATc1NzM0Ng==&osos=VdluDrW3cw==&chnl=b_sa_ch&dr=cHaWck11 ml0eS13DKatcrRPeKVyvExthXN3DKV0vENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1rLQDj rcWDK4m7z0RvmiWAkDjIKiWXzC1NZM3OTMFASDPDdlChV8dNzM1NTL4AZaz&pd=2323UEsJck1p EN07KRBUmNJ i==&campaignId=9jn0AzAyNZgyAZMq  (unitywebplayersetup.exe)

1 / 68      (Adware)
http://great-free.org/?dl=1&pi=OZA1AjazATAw&osos=VdluDrW3cw==&chnl=b_sa_sign_win8&dr=cHaWck1jIHvJ KLm2r0Wc32lDXiyvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1vTQDj rcWDK4m7z0RvmiWAkDjIKiWXzM1AZMzOZMFASDPDdlChV8zNTnFATa4ATiy&pd=2323UExJck1EIXDlUmNJ i==&campaignId=9jn0Aza4AzMdAZMq  (googlechromesetup.exe)

13 / 68    (Adware)
http://great-free.org/?dl=1&pi=AjC1NZ7RATgwOi==&osos=VdluDrW3cw==&chnl=&dr=cHaWck1mIXvlDmW4vExthXN3DKV0AQDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWx0am7dREhKVuvmAWASDChTMm7dlChV80AzM4AzgwOTnm7K2pDZ1fATAyNTaROTn0Ag==&pd=2323UEvP2rLt2XNlUmNJ i==&campaignId=9jn0AziwAjiwAZMq  (firefoxsetup.exe)

1 / 68      (PUP)
http://great-free.org/?dl=1&pi=ATayAjAyAZcRNi==&osos=VdluDrW3cw==&chnl=b_sa_chwin8&dr=c3aW7mcm2r0Wc32lDXimcHaWck13IKFy7XamIT1zvm2yIKiWvmREhKVuvmNjhVVTvmNBDz1l QDjhTnmDZ0wvmNpDZ1fAzg4Nj7FAZCRvm5EIKiWXzi0NzayNzcwAjA=&pd=2323Um5wcHAtDdV0UmNJ i==&campaignId=9jn0AzAFOZadAZMq  (winrarsetup.exe)

1 / 68      (Adware)
http://great-free.org/?dl=1&pi=AjCwNTg1OZc3Ai==&osos=VdluDrW3cw==&chnl=&dr=cHaWck10DK5t2mll2dVyvExthXN3DKV0AQDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWVVAm7dREhKVuvmAWASDChTMm7dlChV80Nzc0OTgwOTnm7K2pDZ1fNTM4OZgyAza0Ag==&pd=2323UmDyDKVBDK2l mxPcECu7dWt&campaignId=9jn0AzayNZMyAZMq  (teamviewer_setup.exe)

1 / 68      (PUP)
http://great-free.org/?dl=1&pi=AjAFNj7wATizNg==&osos=VdluDrW3cw==&chnl=b_sa_ch&dr=cHaWck1Q HVlc3xP7dtzvExthXN3DKV0NkDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWi0nm7dREhKVuvmAWASDChTMm7dlChV80NTL4NzgwOTnm7K2pDZ1fOZg0AzA4ATa0Ag==&pd=2323Um5wcHAt mV3UmNJ i==&campaignId=9jn0AzAyNzLyAZMq  (bluestackssetup.exe)

1 / 68      (PUP)
http://great-free.org/?dl=1&pi=AzMFAZgwOZLdOM==&osos=VdluDrW3cw==&chnl=b_sa_ch&dr=cHaWck1EIK1wvExthXN3DKV0AQDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWVVAm7dREhKVuvmAWASDChTMm7dlChV81AzgzNzCwOTnm7K2pDZ1fAZc3Nzn0OTMyAw==&pd=2323Um5j2rlJ m5C KlyDSFj d0=&campaignId=9jn0AziFAjiwAZMq  (gimpsetup.exe)

7 / 68      (PUP)
http://great-free.org/?dl=1&pi=AjidAji3NTM0Ni==&osos=VdluDrW3cw==&chnl=b_sa_chwin8&dr=cHaWck13IKFC 32zUK1J2mllUK1PIdVyvExthXN3DKV0AQDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWx0am7dREhKVuvmAWASDChTMm7dlChV84AjgdNjCwOTnm7K2pDZ1fAjC3NzM3NzMyAw==&pd=2323UmxJ2d4tcdWm2H2PcmLu7dWt&campaignId=9jn0AzidNjnyAZMq  (windowsmoviemakersetup.exe)

0 / 68
http://great-free.org/?dl=1&pi=OTCdATAdNTAy&osos=VdluDrW3cw==&chnl=&dr=cHaWck1wDr7tcmVPDrVyvExthXN3DKV0vENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1vTQDj rcWDK4m7z0RvmiWAkDjIKiWXzL0Nz7yAZnFASDPDdlChV81AzAFNTMdATaz&pd=2323Uml0UKD1 QFj d0=&campaignId=9jn0AzLRNZAdAZMq  (757157_stp.exe)

The following 3 files have been seen to comunicate with great-free.org in live environments.

TCP » 54.84.143.69:80
WajamInternetEnhancer.exe (Wajam Internet Enhancer by Wajam Internet Technologies)

TCP » 54.84.143.69:80
notifier64.exe (Notifications)

TCP » 54.84.143.69:80
ContentFinder.exe (ContentFinder by ContentFinder Company)

URL:
http://great-free.org/

Title:
“Skype”

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
nginx/1.4.7

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.