» www.reasonabledownload.com
Overview
Analysis
IPs Addresses (1)
Downloads (11)
Website Detail

www.reasonabledownload.com

Moniker Privacy Services (Proxy Registrant)

Domain Information

The domain www.reasonabledownload.com is registered by proxy through Moniker Online Services and was originally registered in February of 2014. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Ashburn, Virginia within the United States which resides on the Amazon.com, Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform.

Registrant:

Moniker Privacy Services

Registrar:

Moniker Online Services

Server location:

Virginia, United States (US)

Create date:

Tuesday, February 11, 2014

Expires date:

Wednesday, February 11, 2015

Updated date:

Tuesday, May 13, 2014

ASN:

AS14618 AMAZON-AES - Amazon.com, Inc.,US

Root domain:

reasonabledownload.com

Whois:

1 reasonabledownload.com record

Scanner detections:

Detections (80% detected)

Scan engine

Details

Detections

Reason Heuristics

PUP.Win.Reputation, Threat.Win.Reputation.IMP, PUP.Installer.Wilmaonline.h, PUP.Installer.Wilmaonline.z, PUP.Installer.Wilmaonline.FF

100.00%

AhnLab V3 Security

PUP/Win32.Amonetiz, PUP/Win32.Amonetize

90.00%

Panda Antivirus

Trj/Genetic.gen

90.00%

Baidu Antivirus

Adware.Win32.Amonetize

90.00%

Malwarebytes

PUP.Optional.Downloader, PUP.Optional.Amonetize

80.00%

Kaspersky

not-a-virus:AdWare.Win32.Amonetize

80.00%

Avira AntiVirus

APPL/Amonetize.Z, Adware/Amonetize.tzv

80.00%

ESET NOD32

Win32/Amonetize.BI (variant), Win32/Amonetize.BN (variant)

80.00%

AVG

Generic, Generic_r

80.00%

NANO AntiVirus

Riskware.Win32.Amonetize.dchxoa, Riskware.Win32.Amonetize.delxsa

70.00%

Dr.Web

Adware.Downware.5913, Adware.Downware.8379

70.00%

McAfee

PUP-Amonetize

70.00%

Zillya! Antivirus

Adware.Amonetize.Win32.922

70.00%

Agnitum Outpost

PUA.Amonetize

70.00%

Qihoo 360 Security

Win32/Virus.Adware.e09

60.00%

The domain www.reasonabledownload.com has been seen to resolve to the following IP address.

50.17.240.123

ec2-50-17-240-123.compute-1.amazonaws.com

September 5, 2014

File downloads found at URLs served by www.reasonabledownload.com.

13 / 68 (Adware)

http://www.reasonabledownload.com/tdownload.php?s1=bdfb85c99e6a351b688cc4d50134ebb235b3c950&t1=1409759978&myref=dm&campid=6666&version=1.1.5.26&instid[appname]=FlashFXP Full 4.4.4 Build 2046 TÃ¼rkÃ§e&instid[appsetupurl]=http://www.myutility.com/setup.exe&instid[cmdline]=/S&instid[appimageurl]=http://www.downloadforall.net/.../downloadall.png&prefix=FlashFXP Full 4.4.4 Build 2046 TÃ¼rkÃ§e&instid[thankyoupage]=http://www.downloadforall.net/.../thankyou.php&ti1=MTE3N3wzNjc5fFRSfDN8MXx8|6cb23ca7a52948f5ea92efd9176a5bd7&AMt=1409759801852&AMh=7fn2b4gxIWmb09igS84d2Ie2zMXUjQgM3KAUfCzDKPbVydo5QZMSwcespsmVBC1AtdCH3iBb48loOaw3 (download.setup__6629_i1258107942_il22411.exe)

13 / 68 (Adware)

http://www.reasonabledownload.com/tdownload.php?s1=5652bccf8ecc4f7dff203efc0446cc8ae2a325be&t1=1409759972&myref=dm&campid=6666&version=1.1.5.26&instid[appname]=FlashFXP Full 4.4.4 Build 2046 TÃ¼rkÃ§e&instid[appsetupurl]=http://www.myutility.com/setup.exe&instid[cmdline]=/S&instid[appimageurl]=http://downloadforall.net/.../downloadall.png&prefix=FlashFXP Full 4.4.4 Build 2046 TÃ¼rkÃ§e&instid[thankyoupage]=http://www.downloadforall.net/.../thankyou.php&ti1=MTE3N3wzNjc5fFRSfDN8MXx8|6cb23ca7a52948f5ea92efd9176a5bd7&AMt=1409759794284&AMh=7fn2b4gxIWmb09igS84d2Ie2zMXUjQgM3KAUfCzDKPbVydo5QZMSwcespsmVBC1AtdCH3iBb48loOaw3 (download.setup__6629_i1258107942_il22411.exe)

22 / 68 (Adware)

http://www.reasonabledownload.com/tdownload.php?s1=4450ae383bed287a60c1f57c934efb235d9abe86&t1=1409874569&myref=dm&campid=10116&version=1.1.5.26&instid[appname]=Piratecity.Net Fast Download Manager&instid[appsetupurl]=http://downloads.sourceforge.net/sevenzip/7z920.exe&instid[appimageurl]=http://costumeplayercatalog.com/wp-content/uploads/2011/.../Deadmans-Chest-Pirate-Flag-Jolly-Roger1-150x150.jpg&prefix=Download Manager Setup&instid[thankyoupage]=Thank You&AMt=1409874460227&AMh=7fn2b4gxIWmb09igS84d2Ie2zMXUjQgM3KAUfCzDKPbVydo5QZMSwcespsmVBC1AtdCH3iBb48loOaw3 (kolay sözlük! »__6183_il1959027.exe)

22 / 68 (Adware)

http://www.reasonabledownload.com/tdownload.php?s1=2e515717875953a5be4a34001f8dc8eff1ba3bcd&t1=1409804963&myref=dm&campid=7630&version=1.1.5.26&instid[appname]=Windows 7 Loader By Daz&instid[appsetupurl]=http://ppvline.com/ppi/Windows 7 Registry Patch.exe&instid[appimageurl]=http://i1088.photobucket.com/albums/i336/frankonlinenet/7load_zps6a68f76b.png&prefix=Windows 7 Loader&instid[thankyoupage]=http://ppvline.com/.../Windows7.html&AMt=1409804782521&AMh=7fn2b4gxIWmb09igS84d2Ie2zMXUjQgM3KAUfCzDKPbVydo5QZMSwcespsmVBC1AtdCH3iBb48loOaw3 (generator box downloader__5160_i1261392509_il315.exe)

17 / 68 (Adware)

http://www.reasonabledownload.com/tdownload.php?s1=3ad88526f0925af28cfe3581cfd7cfaab5c1cd3b&t1=1409861234&myref=dm&campid=3435&version=1.1.5.26&instid[appname]=Final Fantasy II&instid[appsetupurl]=http://www.gamefabrique.com/download/.../final_fantasy_2.exe&instid[appimageurl]=http://www.gamefabrique.com/i/.../final-fantasy-2.png&prefix=Final Fantasy II&AMt=1409861051814&AMh=7fn2b4gxIWmb09igS84d2Ie2zMXUjQgM3KAUfCzDKPbVydo5QZMSwcespsmVBC1AtdCH3iBb48loOaw3 (essential.nettools__2309_il66026.exe)

17 / 68 (Adware)

http://www.reasonabledownload.com/tdownload.php?s1=a8f751091b8cf0ff2cf06fc9c30f7e2e332205c0&t1=1409905297&myref=dm&campid=8173&version=1.1.5.26&instid[appname]=Windows Loader 2.2.2 By Daz&instid[appsetupurl]=https://copy.com/.../Windows Loader Eazy Patch.exe (zyngapokerhack__10076_il2269416.exe)

17 / 68 (Adware)

http://www.reasonabledownload.com/tdownload.php?s1=894b86a1bdea7449cc38380d7dde1c9d47df5aaf&t1=1409814783&myref=dm&campid=9169&version=1.1.5.90&instid[appname]=Software Crack&instid[appsetupurl]=http://get.file2desktop.com/DownloadManager/Get?p=7392&d=10083&l=9525&n=1&instid[appimageurl]=https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcTxoLer5Ytu9PdnrF1WsTHD2cC_Wa2IxWG84gDglmylAXRXLvQu&prefix=Software Crack&instid[thankyoupage]=http://cdn2.business2community.com/wp-content/uploads/2013/.../thank-you-page-295x300.jpg&AMt=1409814573609&AMh=7fn2b4gxIWmb09igS84d2Ie2zMXUjQgM3KAUfCzDKPbVydo5QZMSwcespsmVBC1AtdCH3iBb48loOaw3 (keygen installer__9167_il96.exe)

14 / 68 (Adware)

http://www.reasonabledownload.com/tdownload.php?s1=49937be5a9bdc4ff5472dc14193a349dad84b6dc&t1=1409855640&myref=dm&campid=9168&version=1.1.5.90&instid[appname]=Activation Code Downloader&instid[appsetupurl]=http://get.file2desktop.com/DownloadManager/Get?p=7392&d=10083&l=9525&n=1&instid[appimageurl]=https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcTxoLer5Ytu9PdnrF1WsTHD2cC_Wa2IxWG84gDglmylAXRXLvQu&prefix=Activation Code Downloader&instid[thankyoupage]=http://cdn2.business2community.com/wp-content/uploads/2013/.../thank-you-page-295x300.jpg&AMt=1409855477138&AMh=7fn2b4gxIWmb09igS84d2Ie2zMXUjQgM3KAUfCzDKPbVydo5QZMSwcespsmVBC1AtdCH3iBb48loOaw3 (internet download manager 6.12 beta 1 keygen__7514_il60918.exe)

1 / 68 (false positive)

http://www.reasonabledownload.com/tdownload.php?s1=7a455fb3805880436d2d844d9bf58db9b7d3c1c5&t1=1409860146&myref=dm&campid=9169&version=1.1.5.90&instid[appname]=Software Crack&instid[appsetupurl]=http://get.file2desktop.com/DownloadManager/Get?p=7392&d=10083&l=9525&n=1&instid[appimageurl]=https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcTxoLer5Ytu9PdnrF1WsTHD2cC_Wa2IxWG84gDglmylAXRXLvQu&prefix=Software Crack&instid[thankyoupage]=http://cdn2.business2community.com/wp-content/uploads/2013/.../thank-you-page-295x300.jpg&AMt=1409859965786&AMh=7fn2b4gxIWmb09igS84d2Ie2zMXUjQgM3KAUfCzDKPbVydo5QZMSwcespsmVBC1AtdCH3iBb48loOaw3 (shsetup.exe)

2 / 68 (false positives)

18 / 68 (PUP)

http://www.reasonabledownload.com/tdownload.php?s1=40ed7494369ee1fb3aa75d95cc2166ffc557d333&t1=1409920904&myref=dm (flashplayer__4369_i1094454677_il7.exe)

URL:

http://www.reasonabledownload.com/

Network:

Amazon Web Services (AWS), running an EC2 instance

Web server:

Apache/2.2.15 (Red Hat) (PHP/5.3.3)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.