home

www.optiondownload.com

PERFECT PRIVACY, LLC  (Proxy Registrant)

Domain Information

The domain www.optiondownload.com is registered by proxy through DOMAINHAWKS.NET LLC and was originally registered in January of 2016. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Ashburn, Virginia within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform.
Registrar:
DOMAINHAWKS.NET LLC

Server location:
Virginia, United States (US)

Create date:
Tuesday, January 19, 2016

Expires date:
Thursday, January 19, 2017

Updated date:
Tuesday, January 19, 2016

ASN:
AS14618 AMAZON-AES - Amazon.com, Inc.,US

Root domain:
optiondownload.com

Whois:
3 optiondownload.com records

Scanner detections:
Detections  (93% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Installer.Amonetizeltd.Y, PUP.Installer.ShetefSolutionsConsulting1998.?, PUP.ShetefSolutionsConsulting1998.d, PUP.Installer.ShetefSolutionsConsulting1998.n, Threat.Win.Reputation.IMP
85.71%

Malwarebytes
PUP.Optional.InstallMonetizer, PUP.Optional.Amonetize.A
85.71%

ESET NOD32
Win32/Amonetize.AD (variant), Win32/Amonetize.AG (variant), Win32/Amonetize.AI (variant), Win32/Amonetize.AJ (variant)
85.71%

McAfee
Adware-Amonetize!D5D0E1C3AB27, Artemis!8D3386F3ACE9, Artemis!61BCBC48DE1C, Artemis!113F36A23A03, Artemis!EED95BD36931, Artemis!3D7A2AAABBBC, Adware-Amonetize!DC035ED17CF1, Artemis!C3A15DB2A582, Artemis!5C6BD2794FED, Artemis!1376D59A8986
78.57%

Trend Micro House Call
TROJ_GEN.F47V0202, TROJ_GEN.F47V0303, TROJ_GEN.F47V0305, TROJ_GEN.F47V0309, TROJ_GEN.F47V0313, TROJ_GEN.F47V0310, TROJ_GEN.F47V0320
78.57%

avast!
Win32:Amonetize-E [PUP], Win32:Adware-BJY [PUP], Win32:Amonetize-F [PUP], Win32:Dropper-gen [Drp], Win32:Amonetize-N [PUP]
78.57%

Avira AntiVirus
ADWARE/Adware.Gen2
78.57%

AhnLab V3 Security
PUP/Win32.Amonetiz
71.43%

AVG
Generic_r, MalSign.Wilmo
71.43%

VIPRE Antivirus
Amonetize, Trojan.Win32.Generic
64.29%

Sophos
Amonetize, Generic PUA GM
64.29%

Dr.Web
Adware.Downware.2083, Adware.Downware.1575, Adware.Downware.2250, Adware.Downware.2467, Adware.Downware.2206
57.14%

Fortinet FortiGate
Riskware/Amonetize
57.14%

XVirus List
Win32.Detected, Win.Detected
57.14%

Qihoo 360 Security
HEUR/Malware.QVM01.Gen, Win32/Virus.Adware.932
28.57%

The domain www.optiondownload.com has been seen to resolve to the following 14 IP addresses.

185.53.177.13
July 22, 2016

185.53.177.8
April 18, 2016

50.17.209.45
ec2-50-17-209-45.compute-1.amazonaws.com
May 30, 2014

107.20.210.63
ec2-107-20-210-63.compute-1.amazonaws.com
May 30, 2014

23.21.228.251
ec2-23-21-228-251.compute-1.amazonaws.com
May 30, 2014

50.17.206.16
ec2-50-17-206-16.compute-1.amazonaws.com
May 30, 2014

54.243.209.117
ec2-54-243-209-117.compute-1.amazonaws.com
May 2, 2014

54.243.209.139
ec2-54-243-209-139.compute-1.amazonaws.com
May 2, 2014

107.21.115.114
ec2-107-21-115-114.compute-1.amazonaws.com
April 26, 2014

54.235.68.127
ec2-54-235-68-127.compute-1.amazonaws.com
April 26, 2014

54.235.189.159
ec2-54-235-189-159.compute-1.amazonaws.com
April 3, 2014

54.225.181.84
ec2-54-225-181-84.compute-1.amazonaws.com
March 15, 2014

54.225.132.130
ec2-54-225-132-130.compute-1.amazonaws.com
March 14, 2014

23.21.81.61
ec2-23-21-81-61.compute-1.amazonaws.com
March 7, 2014

File downloads found at URLs served by www.optiondownload.com.

5 / 68      (Adware)
http://www.optiondownload.com/download.php?version=1.1.5.26&campid=3687&instid[appname]=Thuppakki 2012 Hindi Dubbed Downloader&instid[appsetupurl]=http://fastmediadownloads.com/download/Prompt-Downloader-1843983436.exe&instid[cmdline]=&instid[appimageurl]=http://.../logo.png&prefix=Thuppakki 2012 Hindi Dubbed Downloader&instid[thankyoupage]=http://.../?success&instid[interrupted]=http://.../?cancel&ti1=1843983436  (pazerafreeaudioextractorsetup__6131_il1408515.exe)

16 / 68    (Adware)
http://www.optiondownload.com/download.php?version=1.1.5.26&campid=3687&instid[appname]=Zynga Poker Hack Downloader&instid[appsetupurl]=http://fastmediadownloads.com/download/Prompt-Downloader-1973787087.exe&instid[cmdline]=&instid[appimageurl]=http://.../logo.png&prefix=Zynga Poker Hack Downloader&instid[thankyoupage]=http://.../?success&instid[interrupted]=http://.../?cancel&ti1=1973787087  (abbyy.pdf.transformer __2309_il521738.exe)

1 / 68      (Malware)
http://www.optiondownload.com/download.php?version=1.1.5.55&direct=1&prefix=MediaPlayer&campid=3954&capp=MediaPlayer  (flashplayer__4369_i458721123_il15.exe)

30 / 68    (PUP)
http://www.optiondownload.com/download.php?version=1.1.6.20&campid=3154&instid[appname]=PES 6 - Pro Evolution Soccer 6 Free Download PC Game Full Version&instid[appsetupurl]=&instid[cmdline]=&instid[appimageurl]=http://www.people-solutions.co.uk/files/3213/2576/.../download-icon.png&prefix=PES 6 - Pro Evolution Soccer 6 Free Download PC Game Full Version  (windows8activator__5569_il8183621.exe)

11 / 68    (Adware)
http://www.optiondownload.com/download.php?version=1.1.5.26&campid=3497&instid[appname]=Setup File&instid[appsetupurl]=&instid[cmdline]=&instid[appimageurl]=http://www.people-solutions.co.uk/files/3213/2576/.../download-icon.png&prefix=Setup File  (ares__2309_il1424.exe)

12 / 68    (Adware)
http://www.optiondownload.com/download.php?version=1.1.5.26&campid=3687&instid[appname]=Burning Chrome Downloader&instid[appsetupurl]=http://fastmediadownloads.com/download/Prompt-Downloader-1205903033.exe&instid[cmdline]=&instid[appimageurl]=http://.../logo.png&prefix=Burning Chrome Downloader&instid[thankyoupage]=http://.../?success&instid[interrupted]=http://.../?cancel&ti1=1205903033  (downloadsetup__2299_i432274345_il26.exe)

15 / 68    (PUP)
http://www.optiondownload.com/download.php?version=1.1.6.20&campid=3207&instid[appname]=Freemake Video Downloader 3.6.2.2 Full version, Cracked, Serial keys&instid[appsetupurl]=&instid[cmdline]=&instid[appimageurl]=http://www.people-solutions.co.uk/files/3213/2576/.../download-icon.png&prefix=Freemake Video Downloader 3.6.2.2 Full version, Cracked, Serial keys  (goat simulator free full versi downloader__3687_i579356010_il1932077.exe)

19 / 68    (Adware)
http://www.optiondownload.com/download.php?version=1.1.5.26&campid=3687&instid[appname]=Free Video Editting Downloader&instid[appsetupurl]=http://fastmediadownloads.com/download/Prompt-Downloader-1421599383.exe&instid[cmdline]=&instid[appimageurl]=http://.../logo.png&prefix=Free Video Editting Downloader&instid[thankyoupage]=http://.../?success&instid[interrupted]=http://.../?cancel&ti1=1421599383  (volkswagen 2006 jetta owners m downloader__3687_i429776709_il10593438.exe)

11 / 68    (Adware)
http://www.optiondownload.com/download.php?version=1.1.5.26&campid=2963&instid[appname]=Presonus Studio One v2.5.1 Full (32-64bit) Crack Keygen&instid[appsetupurl]=&instid[cmdline]=&instid[appimageurl]=http://www.people-solutions.co.uk/files/3213/2576/.../download-icon.png&prefix=Presonus Studio One v2.5.1 Full (32-64bit) Crack Keygen  (herdprotect__2309_il1072.exe)

11 / 68    (Adware)
http://www.optiondownload.com/download.php?version=1.1.5.26&campid=3687&instid[appname]=8 Ball Pool Hack Downloader&instid[appsetupurl]=http://fastmediadownloads.com/download/Prompt-Downloader-1349977917.exe&instid[cmdline]=&instid[appimageurl]=http://.../logo.png&prefix=8 Ball Pool Hack Downloader&instid[thankyoupage]=http://.../?success&instid[interrupted]=http://.../?cancel&ti1=1349977917  (ares__2309_il1424.exe)

11 / 68    (Adware)
http://www.optiondownload.com/download.php?version=1.1.5.26&campid=2871&instid[appname]=Setup File&instid[appsetupurl]=&instid[cmdline]=&instid[appimageurl]=http://www.people-solutions.co.uk/files/3213/2576/.../download-icon.png&prefix=Setup File  (minecraft premium account gene downloader__3687_i400818195_il6490054.exe)

21 / 68    (PUP)
http://www.optiondownload.com/download.php?version=1.1.5.26&campid=2963&instid[appname]=SpyHunter 4.1.11.0 Full Crack&instid[appsetupurl]=&instid[cmdline]=&instid[appimageurl]=http://www.people-solutions.co.uk/files/3213/2576/.../download-icon.png&prefix=SpyHunter 4.1.11.0 Full Crack  (herdprotect__2309_il720783.exe)

14 / 68    (Adware)
http://www.optiondownload.com/download.php?version=1.1.5.26&campid=3687&instid[appname]=Clash Of Clans Hack Downloader&instid[appsetupurl]=http://fastmediadownloads.com/download/Prompt-Downloader-1373241738.exe&instid[cmdline]=&instid[appimageurl]=http://.../logo.png&prefix=Clash Of Clans Hack Downloader&instid[thankyoupage]=http://.../?success&instid[interrupted]=http://.../?cancel&ti1=1373241738  (painttool sai english pack 1.1.0 full__6923_il1804.exe)

2 / 68      (false positives)
http://www.optiondownload.com/download.php?version=1.1.5.26&campid=3687&instid[appname]=MovieStarPlanet Hack Downloader&instid[appsetupurl]=http://fastmediadownloads.com/download/Prompt-Downloader-1920047871.exe&instid[cmdline]=&instid[appimageurl]=http://.../logo.png&prefix=MovieStarPlanet Hack Downloader&instid[thankyoupage]=http://.../?success&instid[interrupted]=http://.../?cancel&ti1=1920047871  (wrar420.exe)

2 / 68      (false positives)
http://www.optiondownload.com/download.php?version=1.1.5.26&campid=3687&instid[appname]=MovieStarPlanet Hack Tool 2014 Downloader&instid[appsetupurl]=http://fastmediadownloads.com/download/Prompt-Downloader-1710988343.exe&instid[cmdline]=&instid[appimageurl]=http://.../logo.png&prefix=MovieStarPlanet Hack Tool 2014 Downloader&instid[thankyoupage]=http://.../?success&instid[interrupted]=http://.../?cancel&ti1=1710988343  (wrar420.exe)

2 / 68      (false positives)
http://www.optiondownload.com/download.php?version=1.1.5.26&campid=3687&instid[appname]=MovieStar Planet Hack Downloader&instid[appsetupurl]=http://fastmediadownloads.com/download/Prompt-Downloader-1889160535.exe&instid[cmdline]=&instid[appimageurl]=http://.../logo.png&prefix=MovieStar Planet Hack Downloader&instid[thankyoupage]=http://.../?success&instid[interrupted]=http://.../?cancel&ti1=1889160535  (wrar420.exe)

16 / 68    (Adware)
http://www.optiondownload.com/download.php?version=1.1.5.26&campid=3687&instid[appname]=Castle Clash Hack V7 1 2 Downloader&instid[appsetupurl]=http://fastmediadownloads.com/download/Prompt-Downloader-1898308803.exe&instid[cmdline]=&instid[appimageurl]=http://.../logo.png&prefix=Castle Clash Hack V7 1 2 Downloader&instid[thankyoupage]=http://.../?success&instid[interrupted]=http://.../?cancel&ti1=1898308803  (herdprotect__2309_il293354.exe)

5 / 68      (Adware)
http://www.optiondownload.com/download.php?version=1.1.5.26&campid=3687&instid[appname]=Windows 8 Pro Preview Build 9431 Activator Downloader&instid[appsetupurl]=http://fastmediadownloads.com/download/Prompt-Downloader-1284572107.exe&instid[cmdline]=&instid[appimageurl]=http://.../logo.png&prefix=Windows 8 Pro Preview Build 94 Downloader&instid[thankyoupage]=http://.../?success&instid[interrupted]=http://.../?cancel&ti1=1284572107  (pazerafreeaudioextractorsetup__6131_il1408515.exe)

The following 17 files have been seen to comunicate with www.optiondownload.com in live environments.

TCP » 107.20.210.63:80
magiciso maker v54251 spanish__3039_i1081707458_il1646000.exe

TCP » 107.20.210.63:80
gta 5 pc installer__5247_il384.exe

TCP » 185.53.177.8:80
securedocumentsviewer.crx

TCP » 185.53.177.8:80
securedocumentsviewer.crx

TCP » 185.53.177.8:80
securedocumentsviewer.crx

TCP » 23.21.228.251:80
pes.201__7214_il332.exe

TCP » 50.17.206.16:80
Google.Chrome__2309_il52306.exe

TCP » 50.17.206.16:80
Client.exe

TCP » 50.17.206.16:80
Client.exe

TCP » 50.17.206.16:80
file.downloader__9581_il263.exe

TCP » 50.17.209.45:80
pes.201__7214_il332.exe

TCP » 50.17.209.45:80
Client.exe

TCP » 50.17.209.45:80
afirst.exe

TCP » 54.225.181.84:80
EagleGet.exe (EagleGet Downloader by EagleGet.com)

TCP » 54.225.181.84:80
skyhook wifi hack password 2013 zip registration key__3038_i356390957_il5637585.exe (Installer)

TCP » 54.225.181.84:80
kmspico 9.1.3 final, activator all windows and office__4502_il16014.exe (Installer)

TCP » 54.225.181.84:80
updater.exe (Installer)

TCP » 54.225.181.84:80
microsoft office 2013 professional plus full activator crack (32.bit-64.bit)__6266_il12065.exe

URL:
http://www.optiondownload.com/

Title:
“optiondownload.com”

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
nginx

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.