home

install.safeinstall.org

WhoisGuard, Inc.  (Proxy Registrant)

Domain Information

The domain install.safeinstall.org is registered by proxy through eNom, Inc.. This domain has been known to host and distribute adware as well as other potentially unwanted software.
Registrar:
eNom, Inc.

ASN:
AS9498 BBIL-AP BHARTI Airtel Ltd.,IN

Root domain:
safeinstall.org

Whois:
2 safeinstall.org records

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.DownloadandInstall.Y, PUP.DownloadandInstall.M, PUP.installCore.DownloadandInstall.Installer (M)
100.00%

F-Prot
W32/InstallCore.R3.gen
80.00%

Agnitum Outpost
PUA.InstallCore
80.00%

Dr.Web
Trojan.Packed.25266, Trojan.MulDrop5.10078
80.00%

VIPRE Antivirus
InstallCore.b, Threat.4788237
80.00%

Vba32 AntiVirus
Downware.InstallCore
80.00%

Rising Antivirus
PE:Malware.XPACK-LNR/Heur!1.5594
80.00%

ESET NOD32
Win32/InstallCore.ES (variant), Win32/InstallCore.BY (variant)
40.00%

IKARUS anti.virus
Backdoor.Hupigon
40.00%

McAfee
Artemis!12C9A41A9C54
20.00%

Trend Micro House Call
TROJ_GEN.F47V0114
20.00%

ESET NOD32
Win32/InstallCore.BY potentially unwanted application
20.00%

MicroWorld eScan
Gen:Variant.Strictor.53116
20.00%

Bitdefender
Gen:Variant.Strictor.53116
20.00%

Lavasoft Ad-Aware
Gen:Variant.Strictor.53116
20.00%

The domain install.safeinstall.org has been seen to resolve to the following 6 IP addresses.

127.0.0.1
ReasonOne
December 26, 2014

23.0.160.35
a23-0-160-35.deploy.static.akamaitechnologies.com
September 5, 2014

23.0.160.82
a23-0-160-82.deploy.static.akamaitechnologies.com
September 4, 2014

23.0.160.59
a23-0-160-59.deploy.static.akamaitechnologies.com
September 4, 2014

23.67.243.66
a23-67-243-66.deploy.static.akamaitechnologies.com
April 26, 2014

23.67.243.91
a23-67-243-91.deploy.static.akamaitechnologies.com
April 26, 2014

File downloads found at URLs served by install.safeinstall.org.

1 / 68      (Adware)
http://install.safeinstall.org/.../Youtube Downloader.exe  (d19a84dd441d1b532096820399b82019)

10 / 68    (Adware)
http://install.safeinstall.org/.../Easy Torrent.exe  (icreinstall_easy torrent.exe)

8 / 68      (Adware)
http://install.safeinstall.org/.../Easy Torrent.exe  (3720dd76b9b509ea7f5e44f2ea1bf0b9)

15 / 68    (Adware)
http://install.safeinstall.org/.../Easy Torrent.exe  (dc8fe1ac005f66566de3a79aa8c7e06f)

10 / 68    (Adware)
http://install.safeinstall.org/.../Easy Torrent.exe  (icreinstall_easy torrent.exe)

The following 155 files have been seen to comunicate with install.safeinstall.org in live environments.

TCP » 23.0.160.35:80
ciabbpemapmebndipcheflncoinigapj.crx

TCP » 23.0.160.35:80
hola_plugin.exe (Hola by Hola Networks)

TCP » 23.0.160.35:80
gcgllomehplkcmhokgadfooanacligcm.crx

TCP » 23.0.160.35:80
ippenodjaoidmkkfdlmdhofiebnpjddb.crx

TCP » 23.0.160.35:80
eigkliiahgkedfgginlladnjlkldmdbl.crx

TCP » 23.0.160.35:80
mjoimlecacioholedcaellffkcjhocmn.crx

TCP » 23.0.160.59:80
client.exe

TCP » 23.0.160.59:80
ikgeaicnacmnbpkmdhpdkemidfbkfmlf.crx

TCP » 23.0.160.59:80
hpbkjghifbflnidbcfmgpfihnnblieid.crx

TCP » 23.0.160.59:80
ciabbpemapmebndipcheflncoinigapj.crx

TCP » 23.0.160.59:80
bohkmbkclggfaiijbogjkogcpmnglnii.crx

TCP » 23.0.160.59:80
hkcppgdppffkgpgddkngekllghfoiglf.crx

TCP » 23.0.160.59:80
compatibilitycheck.exe

TCP » 23.0.160.59:80
llmcibonccojooiboenghfafpieoabpl.crx

TCP » 23.0.160.59:80
ncmohanoamjdhkfbbkipdahagmcbgphf.crx

TCP » 23.0.160.59:80
dgleklifmalaabpoodkgcbpeheddcihk.crx

TCP » 23.0.160.59:80
wewatcherproxy.exe (WeWatcherProxy.exe by WeWatcher)

TCP » 23.0.160.59:80
ldpgnbhpgiomdikmdpggmbfkejehbfbg.crx

TCP » 23.0.160.59:80
jgdbiopglfmkmgiicaabemfgigcpgpea.crx

TCP » 23.0.160.59:80
hfoohbgccfehlegjimeigjoebfaaccgg.crx

 
Latest 20 of 155 files

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.