home

www.bedownloads.org

Privacy Protection Service INC d/b/a PrivacyProtect.org  (Proxy Registrant)

Domain Information

The domain www.bedownloads.org is registered by proxy through DomainContext, Inc. (R1744-LROR). This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Montreal, Quebec within Canada which resides on the OVH Hosting, Inc. network.
Registrar:
DomainContext, Inc. (R1744-LROR)

Server location:
Quebec, Canada (CA)

Root domain:
bedownloads.org

Whois:
1 bedownloads.org record

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.FaglaroEnterprisesLimited.R
100.00%

Bkav FE
W32.Clodb54.Trojan, W32.Clod58d.Trojan
100.00%

McAfee
Artemis!1FBDCF9C1254, Artemis!062BDA96A95E
100.00%

Malwarebytes
PUP.Optional.ExpressFiles.A
100.00%

K7 AntiVirus
Unwanted-Program
100.00%

Trend Micro House Call
TROJ_GEN.F47V1123, TROJ_GEN.F47V1118
100.00%

avast!
Win32:Downloader-TSH [PUP]
100.00%

Sophos
Express Files
100.00%

VIPRE Antivirus
ExpressFiles Installer
100.00%

AhnLab V3 Security
PUP/Win32.ExpressFiles
100.00%

ESET NOD32
Win32/ExpressFiles (variant)
100.00%

AVG
MalSign.Faglaro Enterprises Limited
100.00%

herdProtect (fuzzy)
a variant of 2b80df6571c45c48ae793fb3a8aca31af677b1e8
100.00%

G Data
Win32.Application.ExpressFiles
100.00%

NANO AntiVirus
Riskware.Win32.Conduit.deoucv
50.00%

The domain www.bedownloads.org has been seen to resolve to the following 2 IP addresses.

167.114.156.214
ns513839.ip-167-114-156.net
June 29, 2016

37.1.202.169
April 14, 2014

File downloads found at URLs served by www.bedownloads.org.

14 / 68    (Adware)
http://www.bedownloads.org/file.php?name=French in Action 1987 52 DVDrips  (uninstall40618651.exe)

25 / 68    (Adware)
http://www.bedownloads.org/file.php?name=Download simatic manager with s7 graph  (uninstall48629234.exe)

The following 36 files have been seen to comunicate with www.bedownloads.org in live environments.

TCP » 167.114.156.214:3333
webproxy.exe

TCP » 167.114.156.214:80
setup_info.exe

TCP » 167.114.156.214:80
tencent.exe (by Tencent)

TCP » 167.114.156.214:80
rs.exe

TCP » 167.114.156.214:80
loader.exe (Updater by SOFTWARE AGILITY LIMITED)

TCP » 167.114.156.214:80
win.exe (SendStat Module)

TCP » 167.114.156.214:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 167.114.156.214:80
ProxyFinder.EXE (Proxy Finder Enterprise Edition Application)

TCP » 167.114.156.214:80
citrio.exe (Citrio by CatalinaGroup)

TCP » 167.114.156.214:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 167.114.156.214:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 167.114.156.214:80
deamon.exe

TCP » 167.114.156.214:80
run_css.exe

TCP » 167.114.156.214:1177
pirater facebook v1.0.exe

TCP » 167.114.156.214:80
Updater.exe (Updater)

TCP » 167.114.156.214:80
internet tv.exe

TCP » 167.114.156.214:80
kingtranslatesetup.exe (KingTranslate by Bandoo Media Inc)

TCP » 167.114.156.214:80
kingtranslatesetup-r0-n-bc.exe (KingTranslate by Koyote-Lab)

TCP » 167.114.156.214:80
ContentFinder.exe (ContentFinder by DigitalSoftware Group)

TCP » 167.114.156.214:80
Updater.exe (Updater)

 
Latest 20 of 41 files

URL:
http://www.bedownloads.org/

Title:
“Download free movies soft, games, crack etc.”

Description:
“Download free muvies soft, games, crack etc.”

Web server:
nginx (PHP/5.2.17)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.