home

i.allfree-apps.net

PERFECT PRIVACY, LLC  (Proxy Registrant)

Domain Information

The domain i.allfree-apps.net is registered by proxy through Network Solutions, LLC and was originally registered in January of 2014. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Dulles, Virginia within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Cloudfront CDN service which utilizes a number of proxy IP Addresses (see below).
Registrar:
Network Solutions, LLC

Server location:
Virginia, United States (US)

Create date:
Monday, January 6, 2014

Expires date:
Tuesday, January 6, 2015

Updated date:
Wednesday, January 22, 2014

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
allfree-apps.net

Whois:
2 allfree-apps.net records

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

VIPRE Antivirus
Rocketfuel Installer, Threat.4786530
93.10%

Reason Heuristics
PUP.VertiTechnologyGroup.CC, PUP.UsefulSoftware.K, PUP.UsefulSoftware.E, PUP.UsefulSoftware.G, PUP.UsefulSoftware.J, PUP.UsefulSoftware.H, PUP.VertiTechnologyGroup.DD, PUP.Verti.UsefulSo.Bundler (M)
93.10%

ESET NOD32
Win32/Verti (variant)
89.66%

Trend Micro House Call
ADW_VERTI, TROJ_GEN.F47V0426, TROJ_GEN.F47V0228, TROJ_GEN.F47V0302, TROJ_GEN.F47V0131, TROJ_GEN.F47V0111, TROJ_GEN.F47V0427
86.21%

Dr.Web
Adware.Downware.2070, Adware.Downware.2712, Adware.Downware.5905
86.21%

Agnitum Outpost
Riskware.Agent
75.86%

Fortinet FortiGate
PossibleThreat.SB!tr.dldr, Riskware/Verti
58.62%

McAfee
Artemis!3B2DD686F757, Artemis!8DB4E2CEF459, Artemis!656F380AC59B, Artemis!DD6FBB10391C, Artemis!BD5F57B9E12F, Artemis!EF9AED947056, Artemis!1CFFF1905176, Artemis!9393A63B947F, Artemis!F4320B4965F8, Artemis!DF59F54383A0, Program.Artemis!20BED7603DED, Artemis!C96BD5645D12
48.28%

Malwarebytes
PUP.Optional.RocketFuel.A, PUP.Optional.NextUp
48.28%

avast!
Win32:Adware-BGF [PUP], Win32:PUP-gen [PUP], Win32:Adware-gen [Adw]
44.83%

AVG
MalSign.Generic, Usefus
41.38%

G Data
Win32.Trojan.Agent.FPR06Z, Win32.Application.Nextup
17.24%

K7 AntiVirus
Trojan , Unwanted-Program
17.24%

Sophos
NextUp, Verti
17.24%

Vba32 AntiVirus
AdWare.Agent
13.79%

The domain i.allfree-apps.net has been seen to resolve to the following 65 IP addresses.

54.192.19.227
server-54-192-19-227.iad12.r.cloudfront.net
June 28, 2016

54.192.19.213
server-54-192-19-213.iad12.r.cloudfront.net
June 28, 2016

54.192.19.205
server-54-192-19-205.iad12.r.cloudfront.net
June 28, 2016

54.192.19.192
server-54-192-19-192.iad12.r.cloudfront.net
June 28, 2016

54.192.19.177
server-54-192-19-177.iad12.r.cloudfront.net
June 28, 2016

54.192.19.146
server-54-192-19-146.iad12.r.cloudfront.net
June 28, 2016

54.192.19.89
server-54-192-19-89.iad12.r.cloudfront.net
June 28, 2016

54.192.19.28
server-54-192-19-28.iad12.r.cloudfront.net
June 28, 2016

52.85.131.173
server-52-85-131-173.iad53.r.cloudfront.net
May 23, 2016

52.85.131.144
server-52-85-131-144.iad53.r.cloudfront.net
May 23, 2016

52.85.131.131
server-52-85-131-131.iad53.r.cloudfront.net
May 23, 2016

52.85.131.124
server-52-85-131-124.iad53.r.cloudfront.net
May 23, 2016

52.85.131.111
server-52-85-131-111.iad53.r.cloudfront.net
May 23, 2016

52.85.131.45
server-52-85-131-45.iad53.r.cloudfront.net
May 23, 2016

52.85.131.22
server-52-85-131-22.iad53.r.cloudfront.net
May 23, 2016

52.85.131.180
server-52-85-131-180.iad53.r.cloudfront.net
May 23, 2016

54.192.54.193
server-54-192-54-193.jfk6.r.cloudfront.net
May 3, 2015

54.192.54.195
server-54-192-54-195.jfk6.r.cloudfront.net
May 3, 2015

54.192.55.161
server-54-192-55-161.jfk6.r.cloudfront.net
May 3, 2015

54.192.54.173
server-54-192-54-173.jfk6.r.cloudfront.net
May 3, 2015

54.230.55.223
server-54-230-55-223.jfk6.r.cloudfront.net
May 3, 2015

54.192.54.198
server-54-192-54-198.jfk6.r.cloudfront.net
May 3, 2015

54.230.52.91
server-54-230-52-91.jfk6.r.cloudfront.net
May 3, 2015

54.230.53.82
server-54-230-53-82.jfk6.r.cloudfront.net
May 3, 2015

54.230.192.157
server-54-230-192-157.iad53.r.cloudfront.net
December 22, 2014

54.230.19.16
server-54-230-19-16.iad12.r.cloudfront.net
September 4, 2014

54.230.19.13
server-54-230-19-13.iad12.r.cloudfront.net
September 4, 2014

54.230.17.43
server-54-230-17-43.iad12.r.cloudfront.net
September 4, 2014

54.230.16.238
server-54-230-16-238.iad12.r.cloudfront.net
September 4, 2014

54.240.160.169
server-54-240-160-169.iad12.r.cloudfront.net
September 4, 2014

 
Showing 30 of 65 IP Addresses

File downloads found at URLs served by i.allfree-apps.net.

11 / 68    (Adware)
http://i.allfree-apps.net/stub/.../PDFCreator_RocketFuelInstaller.exe  (dd6fbb10391ca48f619411d459db8dcb)

1 / 68      (Adware)
http://i.allfree-apps.net/stub/.../PDFCreator.exe  (706659f688e8c353ffe5c9e6eb18f717)

13 / 68    (Adware)
http://i.allfree-apps.net/stub/.../MediaPlayerClassicInstaller.exe  (20bed7603dedb8d2c56a7b7b92f89b44)

11 / 68    (Adware)
http://i.allfree-apps.net/stub/.../PopcornTV_RocketFuelInstaller.exe  (1370d019e85bdbe2e91dfb28a21a144e)

14 / 68    (Adware)
http://i.allfree-apps.net/stub/.../MediaPlayerClassicInstaller.exe  (8b3093c60ab13d551b7ee1f438ba0f1e)

9 / 68      (Adware)
http://i.allfree-apps.net/stub/.../Flv2PC_RocketFuelInstaller.exe  (e80317f7ec1c3d3075f53a92a16dd12b)

11 / 68    (Adware)
http://i.allfree-apps.net/stub/.../MixxxDJInstaller.exe  (ad16c15ffdc127f6cfab2b1575432cc1)

6 / 68      (Adware)
http://i.allfree-apps.net/stub/.../Gimp.exe  (9393a63b947f4786b843346a2bb06602)

6 / 68      (Adware)
http://i.allfree-apps.net/stub/.../Audacity.exe  (df59f54383a052ae00effa82270bb26e)

15 / 68    (Adware)
http://i.allfree-apps.net/stub/.../MixxxDJInstaller.exe  (c51e183631e68cd9aee6c9f6f48c5e9d)

13 / 68    (Adware)
http://i.allfree-apps.net/stub/.../PDFCreator_RocketFuelInstaller.exe  (f4320b4965f8eb266d3269d5439b2dc7)

10 / 68    (Adware)
http://i.allfree-apps.net/stub/.../FlightSim_RocketFuelInstaller.exe  (aa6c5c893d0f006398199576b3cc5163)

7 / 68      (Adware)
http://i.allfree-apps.net/stub/.../PDFCreator.exe  (fceaa301a9df326c460806fd1ad7e282)

11 / 68    (Adware)
http://i.allfree-apps.net/stub/.../Audacity_RocketFuelInstaller.exe  (8db4e2cef459aec6f67aa1c8f9542c93)

8 / 68      (Adware)
http://i.allfree-apps.net/stub/.../PDFCreator_RocketFuelInstaller.exe  (efc62554642b17415f2847b9b67caeda)

11 / 68    (Adware)
http://i.allfree-apps.net/stub/.../PDFCreator.exe  (9bfb352ff6680805631cfefb8eac1bf5)

8 / 68      (Adware)
http://i.allfree-apps.net/stub/.../Gimp.exe  (1cfff1905176e1169b198259a679d3bb)

7 / 68      (Adware)
http://i.allfree-apps.net/stub/.../FlightSim.exe  (ef9aed94705601b3959891506a4cdc6e)

8 / 68      (Adware)
http://i.allfree-apps.net/stub/.../Audacity.exe  (bd5f57b9e12fbd9a0e5bf54a93d1a9f0)

8 / 68      (Adware)
http://i.allfree-apps.net/stub/.../PopcornTV.exe  (5b931cd2aec2a8e0271ab022151156c7.exe)

10 / 68    (Adware)
http://i.allfree-apps.net/stub/.../Gimp_RocketFuelInstaller.exe  (656f380ac59bfce15623c44f161858df)

8 / 68      (Adware)
http://i.allfree-apps.net/stub/.../Flv2PC_RocketFuelInstaller.exe  (ed2bdbfc2d07d8e9d096b00de5495736)

7 / 68      (Adware)
http://i.allfree-apps.net/stub/.../PDFCreator.exe  (16c261ad038d873dd391edcbfdb9c752)

7 / 68      (Adware)
http://i.allfree-apps.net/stub/.../MixxxDJ.exe  (2a7965a806286e2c0cf22c4abbcaa767)

7 / 68      (Adware)
http://i.allfree-apps.net/stub/.../Gimp.exe  (ba15e5a60eb12a2e4810e65dc8407926)

7 / 68      (Adware)
http://i.allfree-apps.net/stub/.../Flv2PC.exe  (f6b93dd8661e65482fb993bb6887580c)

7 / 68      (Adware)
http://i.allfree-apps.net/stub/.../FlightSim.exe  (6ca6e8855d3278ff521b27eee38bf7f7)

2 / 68      (Adware)
http://i.allfree-apps.net/stub/.../Audacity.exe  (b0cfc9113ca3c79d432c09cd39e0e394)

14 / 68    (Adware)
http://i.allfree-apps.net/stub/.../Audacity_RocketFuelInstaller.exe  (50c9c9f8535f30ca601dc583205520b6)

The following 502 files have been seen to comunicate with i.allfree-apps.net in live environments.

TCP » 54.192.19.146:80
GoRadio.exe (RP by Resilion)

TCP » 184.26.44.104:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 54.192.19.192:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 54.192.19.213:80
jingling.exe

TCP » 184.26.44.96:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 54.192.19.192:80
saber.exe

TCP » 54.192.19.213:80
interhop.exe

TCP » 184.26.44.104:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 54.192.19.192:80
saber.exe

TCP » 184.26.44.96:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 54.192.19.205:80
notification.exe

TCP » 54.192.19.177:80
winsaber.exe

TCP » 54.192.19.192:80
saber.exe

TCP » 54.192.19.192:80
browserairexec.exe (BrowserAir by Goobzo)

TCP » 54.192.19.205:80
saber.exe

TCP » 184.26.44.96:80
dailywiki.exe

TCP » 184.26.44.104:80
dailywiki.exe

TCP » 54.192.19.205:80
phujitythaseengplb.exe

TCP » 54.192.19.89:443
online-guardian-v2.0.9.exe

TCP » 54.192.55.161:80
UCBrowser.exe (UC Browser by UCWeb)

 
Latest 20 of 558 files

URL:
http://i.allfree-apps.net/

Network:
Amazon Cloudfront

Web server:
AmazonS3

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.