» www.phdowns.com
Overview
Analysis
IPs Addresses (12)
Downloads (28)
Network (24)
Website Detail
Statistics

www.phdowns.com

Pedro Henrique Guimar�es de Souza

Domain Information

The domain www.phdowns.com registered by Pedro Henrique Guimar�es de Souza was initially registered in May of 2013 through UNIVERSO ONLINE S/A (UOL). This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Mountain View, California within the United States which resides on the Google Inc. network.

Registrant:

Pedro Henrique Guimar�es de Souza

Registrar:

UNIVERSO ONLINE S/A (UOL)

Server location:

California, United States (US)

Create date:

Monday, May 6, 2013

Expires date:

Sunday, May 6, 2018

Updated date:

Friday, January 15, 2016

ASN:

AS15169 GOOGLE - Google Inc.

Root domain:

phdowns.com

Whois:

2 phdowns.com records

Scanner detections:

Detections (100% detected)

Scan engine

Details

Detections

Reason Heuristics

PUP.SITEONSPOT.EE, PUP.Somoto.i, PUP.Somoto.q, PUP.Somoto.p, PUP.Somoto.?, PUP.Somoto.DD, PUP.Somoto.EE, PUP.Somoto.I, Threat.Installer.SITEONSPOT, PUP.Somoto.SITEONSPOT.Bundler (M), PUP.Somoto.Bundler (M), Adware.Somoto.Installer.Meta (M)

95.45%

Sophos

Somoto BetterInstaller

68.18%

AVG

Generic

68.18%

Dr.Web

Trojan.Packed.26824, Trojan.Packed.28357

63.64%

Kaspersky

not-a-virus:AdWare.Win32.Agent, not-a-virus:Downloader.Win32.Agent

63.64%

Baidu Antivirus

Adware.Win32.Agent, Adware.Win32.Somoto

63.64%

avast!

Somoto-P [PUP], Win32:Somoto-P [PUP], Win32:Somoto-R [PUP]

59.09%

NANO AntiVirus

Riskware.Nsis.Adware.dbnhrj, Riskware.Win32.Downware.digcac

59.09%

Clam AntiVirus

Win.Adware.Somoto

59.09%

SUPERAntiSpyware

PUP.Somoto/Variant

59.09%

Avira AntiVirus

APPL/Somoto.hzis, APPL/Somoto.Gen2

59.09%

Qihoo 360 Security

HEUR/Malware.QVM06.Gen, HEUR/QVM42.0.Malware.Gen, Trojan.Generic, Win32/Virus.Downloader.192, Win32/Application.6bb

50.00%

AhnLab V3 Security

Win-PUP/Somoto

50.00%

VIPRE Antivirus

Threat.4783461, BetterInstaller, Threat.4150696, Trojan.Win32.Generic

27.27%

Panda Antivirus

Trj/Chgt.E, PUP/MultiToolbar.A

27.27%

The domain www.phdowns.com has been seen to resolve to the following 12 IP addresses.

August 6, 2016

July 20, 2016

July 5, 2016

July 1, 2016

May 26, 2016

ib-in-f121.1e100.net

May 6, 2016

173.194.205.121

March 4, 2016

64.233.171.121

February 1, 2015

173.194.68.121

qa-in-f121.1e100.net

December 31, 2014

173.194.76.121

qc-in-f121.1e100.net

November 29, 2014

74.125.29.121

qg-in-f121.1e100.net

November 29, 2014

74.125.22.121

qh-in-f121.1e100.net

October 9, 2014

File downloads found at URLs served by www.phdowns.com.

1 / 68 (Adware)

http://www.phdowns.com/.../ATIVADOR_Windows_7_DEFINITIVO_Todas_as_Vers_es_32_64_Bits_PH_DownsSetup-IdO5mQaA2.exe (adf441c846a7719c8a51b28152f44bba)

15 / 68 (Adware)

http://www.phdowns.com/.../Download_Minecraft_1_7_10_Pirata_Completo_PH_DownsSetup-QcKK0AeFH.exe (velhas-virgens-ninguém-beija-como-as-lésbicas_downloader-i6wpqhzzn.exe)

14 / 68 (Adware)

http://www.phdowns.com/.../Download_Minecraft_1_7_10_Pirata_Completo_PH_DownsSetup-QbTX8AAF9.exe (flvplayer_downloader-naf9fjg9p.exe)

21 / 68 (Adware)

http://www.phdowns.com/.../Minecraft_1_7_10_Pirata_Completo_PH_DownsSetup-IcPaR420h.exe (flvplayer_downloader-n6rg4ooz4.exe)

15 / 68 (Adware)

http://www.phdowns.com/.../ATIVADOR_Windows_7_DEFINITIVO_Todas_as_Versoes_32_64_Bits_PH_DownsSetup-Ic4vhvNSX.exe (velhas-virgens-ninguém-beija-como-as-lésbicas_downloader-i6wpqhzzn.exe)

13 / 68 (Adware)

http://www.phdowns.com/.../ATIVADOR_Windows_7_DEFINITIVO_Todas_as_Versoes_32_64_Bits_PH_DownsSetup-I7TdNAgGe.exe (filedownloadedsuccessfully_downloader-n51exb4il.exe)

1 / 68 (Adware)

http://www.phdowns.com/.../ATIVADOR_Windows_7_DEFINITIVO_Todas_as_Vers_es_32_64_Bits_PH_DownsSetup-IaWgUbAut.exe (088a8169f8b11093b9b19c5b2ddccd9c)

21 / 68 (Adware)

http://www.phdowns.com/.../ATIVADOR_Windows_7_DEFINITIVO_Todas_as_Vers_es_32_64_Bits_PH_DownsSetup-IbRwvueYN.exe (00000150)

20 / 68 (Adware)

http://www.phdowns.com/.../Minecraft_1_7_2_PIRATA_Completo_PH_DownsSetup-IcRhILZnX.exe (flvplayer_downloader-nbnfmlfol.exe)

1 / 68 (PUP)

http://www.phdowns.com/.../Minecraft_1_7_2_PIRATA_Completo_PH_DownsSetup-IcRhILZnX.exe (287dfb3eac53665ab1252c6c50f10529)

1 / 68 (PUP)

http://www.phdowns.com/.../Minecraft_1_7_2_PIRATA_Completo_PH_DownsSetup-IcRhILZnX.exe (555f7be4a5549c956921196d2388253b)

1 / 68 (PUP)

http://www.phdowns.com/.../Minecraft_1_7_2_PIRATA_Completo_PH_DownsSetup-IcRhILZnX.exe (d917ff94705b9ae653db384f0b0c9875)

20 / 68 (Adware)

http://www.phdowns.com/.../Minecraft_1_7_2_PIRATA_Completo_PH_DownsSetup-Ia3Qz0itm.exe (flvplayer_downloader-naxmfvina.exe)

15 / 68 (Adware)

http://www.phdowns.com/.../Download_Minecraft_1_6_4_PIRATA_Completo_Novo_Launcher_PH_DownsSetup-IfscaOzGa.exe (velhas-virgens-ninguém-beija-como-as-lésbicas_downloader-i6wpqhzzn.exe)

12 / 68 (Adware)

http://www.phdowns.com/.../Download_Minecraft_1_7_10_Pirata_Completo_PH_DownsSetup-Qed7fYlVL.exe (00000000)

12 / 68 (Adware)

http://www.phdowns.com/.../Download_Minecraft_1_7_10_Pirata_Completo_PH_DownsSetup-Q10SpQqOx.exe (filedownloadedsuccessfully_downloader-n295rn8sp.exe)

16 / 68 (Adware)

http://www.phdowns.com/.../Ativador_Office_2013_DEFINITIVO_Atualizado_2014_PH_DownsSetup-IfZ98Kplp.exe (filedrop_downloader-i6aeasrzt.exe)

13 / 68 (Adware)

http://www.phdowns.com/.../Download_Minecraft_1_7_10_Pirata_Completo_PH_DownsSetup-Qdusi8a2h.exe (filedownloadedsuccessfully_downloader-n51exb4il.exe)

1 / 68 (Adware)

http://www.phdowns.com/.../Download_Minecraft_1_7_9_Pirata_Completo_PH_DownsSetup-I0kmuoqBW.exe (73e93bb2553d188bfa5485ab396d70ef)

16 / 68 (Adware)

http://www.phdowns.com/.../Sony_Vegas_Pro_13_Crack_Download_Completo_PH_DownsSetup-IcLI1oZ4S.exe (download-freakshare_downloader-icb6rpo1f.exe)

1 / 68 (Adware)

http://www.phdowns.com/.../ATIVADOR_Windows_7_DEFINITIVO_Todas_as_Vers_es_32_64_Bits_PH_DownsSetup-IbIwgAmJn.exe (56e1f0fe751c06665f0cd28f03f4cc6a)

13 / 68 (Adware)

http://www.phdowns.com/.../Download_Minecraft_1_7_10_Pirata_Completo_PH_DownsSetup-Q36DT6uAS.exe (thebigstorefrenchdvdrip2014_downloader-n21uwljxq.exe)

12 / 68 (Adware)

http://www.phdowns.com/.../ATIVADOR_Windows_7_DEFINITIVO_Todas_as_Versoes_32_64_Bits_PH_DownsSetup-Q3ITqpSsn.exe (filedownloadedsuccessfully_downloader-n295rn8sp.exe)

16 / 68 (Adware)

http://www.phdowns.com/.../Adobe_After_Effects_CC_Download_Crack_ATIVADOR_Full_PH_DownsSetup-Q9gmU2vgT.exe (filedrop_downloader-i6aeasrzt.exe)

12 / 68 (Adware)

http://www.phdowns.com/.../CorelDRAW_X7_Crack_Portugues_BR_32_64_Bits_Completo_PH_DownsSetup-I9LT3XYEp.exe (filedownloadedsuccessfully_downloader-n9ozn5uze.exe)

13 / 68 (Adware)

http://www.phdowns.com/.../Driver_Genius_Professional_14_Crack_PH_DownsSetup-I2PWCWsK5.exe (filedownloadedsuccessfully_downloader-nfe9xgiaj.exe)

15 / 68 (Adware)

http://www.phdowns.com/.../Sony_Vegas_Pro_13_Crack_Download_Completo_PH_DownsSetup-IbsIXiULV.exe (velhas-virgens-ninguém-beija-como-as-lésbicas_downloader-i6wpqhzzn.exe)

23 / 68 (PUP)

http://www.phdowns.com/.../ATIVADOR_Windows_7_DEFINITIVO_Todas_as_Vers_es_32_64_Bits_PH_DownsSetup-IeC7aXsqA.exe (e3da15c8911d4ba2deee0ea995d492a7)

The following 24 files have been seen to comunicate with www.phdowns.com in live environments.

TCP » 74.125.22.121:80

feeddemon.exe (by NewsGator Technologies)

TCP » 173.194.207.121:443

chrome.crx

TCP » 173.194.207.121:80

feedly.crx

TCP » 173.194.68.121:80

javaw.exe (Java Platform SE 7 U25 by Oracle)

TCP » 173.194.68.121:80

new_chrome.exe (Google Chrome by Google)

TCP » 209.85.144.121:443

Client.exe

TCP » 209.85.144.121:80

rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 64.233.171.121:80

1p1m8l01stw==53.exe

TCP » 64.233.171.121:80

1qvrflepsta==5.exe

TCP » 64.233.171.121:80

ufurate.exe

TCP » 64.233.171.121:80

tiwash.exe

TCP » 64.233.171.121:80

nuhlatin.exe

TCP » 74.125.192.121:80

feeddemon.exe (by NewsGator Technologies)

TCP » 74.125.22.121:80

new_chrome.exe (Google Chrome by Google)

TCP » 74.125.22.121:80

new_chrome.exe (Google Chrome by Google)

TCP » 74.125.22.121:80

1qfrak1juua==3.exe

TCP » 74.125.22.121:80

1pljatvnq5.exe

TCP » 74.125.22.121:80

Explore.exe (Chromium by The Chromium Authors)

TCP » 74.125.22.121:80

osizavoo.exe

TCP » 74.125.29.121:80

snackr.exe

Latest 20 of 25 files

URL:

http://www.phdowns.com/

Title:

“PH Downs”

Description:

“Downloads de softwares e programas gratuito. Os melhores links, você só encontra aqui.”

Web server:

GSE

Facebook:

Likes: 374

Shares: 246

Comments: 120

Statistics are for the previous month.

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.