home

www.fr.dlnowsoft.com

Sylvestre Alan

Domain Information

The domain www.fr.dlnowsoft.com registered by Sylvestre Alan was initially registered in June of 2015 through OVH. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Roubaix, Nord-Pas-De-Calais within France which resides on the RIPE Network Coordination Centre network.
Registrar:
OVH

Server location:
Nord-Pas-De-Calais, France (FR)

Create date:
Friday, June 12, 2015

Expires date:
Sunday, June 12, 2016

Updated date:
Thursday, November 5, 2015

ASN:
AS16276 OVH OVH Systems

Root domain:
dlnowsoft.com

Whois:
1 dlnowsoft.com record

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Logixoft.Installer (M)
100.00%

The domain www.fr.dlnowsoft.com has been seen to resolve to the following IP address.

213.186.33.2
cluster002.ovh.net
June 7, 2016

File downloads found at URLs served by www.fr.dlnowsoft.com.

1 / 68      (Adware)
http://www.fr.dlnowsoft.com/dlnow_setup.exe  (uninst.exe)

The following 23 files have been seen to comunicate with www.fr.dlnowsoft.com in live environments.

TCP » 213.186.33.2:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 213.186.33.2:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 213.186.33.2:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 213.186.33.2:80
UCBrowser.exe (by UCWeb)

TCP » 213.186.33.2:80
online-guardian-v2.0.9.exe

TCP » 213.186.33.2:80
apptrailers.exe

TCP » 213.186.33.2:80
browser.exe (speed browser by Smart Applications)

TCP » 213.186.33.2:80
online-guardian-v2.0.9.exe

TCP » 213.186.33.2:80
Havij.exe (Havij by ITSecTeam)

TCP » 213.186.33.2:80
onlineguardian-v2.exe

TCP » 213.186.33.2:80
sumo.exe (SUMo by KC Softwares)

TCP » 213.186.33.2:587
wrk.exe

TCP » 213.186.33.2:80
sumo.exe (SUMo by KC Softwares)

TCP » 213.186.33.2:80
avwebgrd.exe (Avira Product Family by Avira Operations GmbH & Co. KG)

TCP » 213.186.33.2:80
sumo.exe (SUMo by KC Softwares)

TCP » 213.186.33.2:80
sumo.exe (SUMo by KC Softwares)

TCP » 213.186.33.2:80
sumo.exe (SUMo by KC Softwares)

TCP » 213.186.33.2:80
ymsgr_tray.exe (Yahoo! Messenger by Yahoo!)

TCP » 213.186.33.2:80
Connectify.exe (Connectify)

TCP » 213.186.33.2:80
PandoraService.exe (by Pandora.TV)

 
Latest 20 of 25 files

URL:
http://www.fr.dlnowsoft.com/

Google Analytics:
UA-3273946

Title:
“DLNow Video Downloader - Télécharger des vidéos et MP3 YouTube”

Description:
“Télécharger gratuitement des vidéos et MP3 sur YouTube, Dailymotion, Twitch, Facebook et bien plus encore.”

SSL certificate subject:
CN=logixoft.com

SSL certificate issuer:
CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US

Web server:
Apache (PHP/5.6.21)

logixoft.com

logixoft.net

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.